The fastest way to kill a retail AI deal:
an agent with write access and no audit trail.
Ward starts read-only, runs on policy, and logs every query. Architecture, MSA, DPA, SOC 2 report, and certificate of insurance are on the table before you sign.
These aren’t hypotheticals.
They’re the last two years of headlines.
Every failure mode below is on the public record. Here is what stops each one.
Sources: LayerX Enterprise AI & SaaS Data Security Report (2025) · Replit production-database incident (2025) · OpenAI developer community.
Read-only by default.
Writes need a named human.
Read-only against your warehouse, POS, and ERP. Writes gate on a role you define, logged with the approver’s name.
SELECT on whitelisted schemas. No INSERT, UPDATE, or DELETE. Every agent runs a Cedar policy, versioned in Git and signed. Not in the repo means not in production.Policy as code.
Not click-admin drift.
The policy plane, kill switch, and audit trail your team would build with a free quarter.
// Finance Agent: read-only on warehouse.finance,
// no PII, region-scoped, writes require approval.
permit (
principal in Role::"FinanceAgent",
action in [Action::"read", Action::"summarize"],
resource in Source::"warehouse.finance"
)
when {
resource.classification != "pii"
&& context.region == principal.region
&& context.budget.tokens > 1000
};
forbid (
principal,
action == Action::"write",
resource
)
unless {
context.approval.status == "granted"
&& context.approval.approver in Role::"FinanceLead"
};-
Policy as code, visualizedCedar policies in your Git: versioned, reviewed, signed. The console renders each rule as a graph, so IT reads policy without reading Cedar.
-
Scoped per role, tenant, resourceFinance Agent cannot see labor schedules. Vendor Agent cannot touch shrinkage. US tenant cannot query EU tables. Least-privilege, machine-enforced.
-
Classifications drive accessTag a column
pii,financial, oroperationalonce. Every agent and query inherits the rule. -
Who changed what, on the recordCharter edits, prompt changes, policy updates: logged with name, time, ticket, approver. Diff, roll back, export to your SIEM.
-
Writes need a named humanExports, write-backs, schedule pushes. Anything that mutates state gates on a role you define, logged with the approver.
-
Audit any number on the pageClick a forecast, a margin call, a shrink flag. Ward shows the SQL, source tables, model, parameters, and backtest.
Your data, your keys, your region.
Processed only to deliver the service. Nothing trains a public model. Nothing leaves your region without a contract that allows it.
TLS 1.3 in transit. AES-256 at rest. Key material in AWS KMS or your HSM.
SAML 2.0 against your IdP. SCIM provisioning, so access follows the org chart.
Least-privilege roles per agent, tenant, and resource. Finance can’t see labor; US can’t query EU tables.
Every prompt, query, model call, and approval is logged with name, time, and ticket. Streams to your SIEM.
CMK on request, KMS or HSM-backed. You rotate and revoke. Ward never sees the key material.
Single-tenant in your AWS or Azure account via VPC peering or PrivateLink.
Region pins at the tenant level: us-east-1 / us-west for US, Frankfurt and Dublin for EU, Tokyo for Japan.
Retention per data class. Hard delete 30 days post-termination, wipe logged.
Customer data is never used to train a public foundation model: tenant-scoped fine-tunes only, opt-in by contract.
Where we are, and where we’re going.
Everything below is current status. Need something before signing? Ask, and we send it or tell you when. The evaluation packet collects all of it on one printable page.
Every vendor that touches your data.
Listed below. Change one and we email 30 days ahead, with an objection window per the DPA. How a review runs:
Architecture packet, MSA, DPA, pre-filled CAIQ or SIG Lite, in a business day.
Pick the boundary: multi-tenant SaaS, single-tenant VPC, or PrivateLink in your own account.
Read-only credentials, scoped to the schemas you whitelist. No write access until you grant it.
Cedar policies signed in your repo. Every query and approval streams to your SIEM, on the record.
Single-tenant deployments can exclude any third-party LLM. Self-hosted open-weight models supported on request.
Coverage on file.
Response on the clock.
In force, with an AI rider for errors in model output. Carrier name and COI to procurement within one business day.
- Cyber liability with breach response
- Tech E&O with AI/ML rider
- Additional insured endorsement on request
- COI delivered via email or vendor portal
Documented runbook. Customer notification SLA per the DPA. Post-incident report with root cause and corrective action.
- Detection: 24/7 SIEM alerting
- Triage: on-call within 15 minutes
- Notification: 72 hours per DPA
- Postmortem: within 14 days
On the table before you sign.
Most arrive within a business day. The few under NDA need a one-page MNDA first.
Found something? Tell us.
Coordinated disclosure. Response in one business day, triage in three, researchers credited in the changelog.
Your security review starts with a short list of questions.
Architecture, MSA, DPA, SOC 2 letter, COI. On the table before you sign.
Read-only to start · your LLM keys · SOC 2 Type II underway · or book a call directly
Find out what your data has been hiding.
Tell us about your operation. We’ll show you the problems Ward catches, and the ones your current tools miss.