The fastest way to kill a retail AI deal:
an agent with write access and no audit trail.
Ward starts read-only, runs on policy, and logs every query. Architecture, MSA, DPA, SOC 2 report, and certificate of insurance are on the table before you sign.
Read-only by default.
Writes need a named human.
Ward queries your warehouse, POS, and ERP with read-only credentials. Anything that writes (exports, write-backs, schedule pushes) gates on sign-off from a role you define, logged with the approver’s name.
SELECT on the schemas you whitelist, no INSERT/UPDATE/DELETE, confirmable in your warehouse audit log. Every agent runs under a Cedar policy, versioned in Git, peer-reviewed, and signed. Not in the repo means not in production.Policy as code.
Not click-admin drift.
The policy plane, kill switch, and audit trail your team would build with a free quarter. Enterprise-grade governance, no enterprise team required.
// Finance Agent: read-only on warehouse.finance,
// no PII, region-scoped, writes require approval.
permit (
principal in Role::"FinanceAgent",
action in [Action::"read", Action::"summarize"],
resource in Source::"warehouse.finance"
)
when {
resource.classification != "pii"
&& context.region == principal.region
&& context.budget.tokens > 1000
};
forbid (
principal,
action == Action::"write",
resource
)
unless {
context.approval.status == "granted"
&& context.approval.approver in Role::"FinanceLead"
};-
Policy as code, visualizedCedar policies live in your Git. Versioned, peer-reviewed, signed. The console renders every rule as a graph: agent, action, source, condition. Your IT team reads policy without reading Cedar.
-
Scoped per role, tenant, resourceFinance Agent cannot see labor schedules. Vendor Agent cannot touch shrinkage. US tenant cannot query EU tables. Least-privilege, machine-enforced.
-
Classifications drive accessTag a column
pii,financial, oroperationalonce. Every agent, every query inherits the rule. No copies of the policy to keep in sync. -
Who changed what, on the recordEvery charter edit, prompt change, and policy update is logged with name, time, ticket, and approver. Diff two versions side by side. Roll back in one click. Export to your SIEM.
-
Writes need a named humanRead-only by default. Exports, write-backs, schedule pushes. Anything that mutates state gates on approval from a role you define. Logged with the approver’s identity.
-
Audit any number on the pageClick a forecast, a margin call, a shrinkage flag. Ward shows the SQL, the source tables, the model, the parameters, and the backtest. Procurement stops asking how the number was made.
Your data, your keys, your region.
Ward processes your data only to deliver the service. Nothing trains a public model. Nothing leaves your region without a contract that allows it.
TLS 1.3 in transit. AES-256 at rest. Key material in AWS KMS or your HSM.
SAML 2.0 single sign-on against your IdP. SCIM provisioning and de-provisioning, so access follows the org chart.
Least-privilege roles per agent, tenant, and resource. Finance can’t see labor; US can’t query EU tables.
Every prompt, query, model call, and approval is logged with name, time, and ticket. Streams to your SIEM.
CMK on request, KMS or HSM-backed with envelope encryption. You rotate, revoke, and hold the receipts; Ward never sees the key material.
Single-tenant inside your AWS or Azure account via VPC peering or PrivateLink. Your network, your account, your boundary.
Region pins at the tenant level: us-east-1 / us-west for US, Frankfurt and Dublin for EU, Tokyo for Japan.
Configurable retention per data class. Hard delete in 30 days post-termination, wipe logged. Full sub-processor list below.
Customer data is never used to train a public foundation model — tenant-scoped fine-tunes only, opt-in by contract.
Where we are, and where we’re going.
Status, not aspiration: what’s in place, what’s in flight, and when each item lands. Need something before signing? Ask, and we’ll send it or tell you when.
Every vendor that touches your data.
Listed below. Change one and we email you 30 days ahead, with an objection window per the DPA. Here’s how a security review runs, end to end:
Architecture packet, MSA, DPA, and pre-filled questionnaire (CAIQ, SIG Lite) to your team in a business day.
Pick the boundary: multi-tenant SaaS, single-tenant VPC, or PrivateLink in your own account.
Read-only credentials, scoped to the schemas you whitelist. No write access until you grant it.
Cedar policies signed in your repo. Every query and approval streams to your SIEM, on the record.
Single-tenant deployments can exclude any third-party LLM. Self-hosted open-weight models supported on request.
Coverage on file.
Response on the clock.
Cyber liability and tech E&O coverage in force, with an AI rider for errors in model output. Carrier name and certificate of insurance to your procurement team within one business day.
- Cyber liability with breach response
- Tech E&O with AI/ML rider
- Additional insured endorsement on request
- COI delivered via email or vendor portal
Documented runbook. Customer notification SLA per the DPA. Post-incident report with root cause and corrective action.
- Detection: 24/7 SIEM alerting
- Triage: on-call within 15 minutes
- Notification: 72 hours per DPA
- Postmortem: within 14 days
On the table before you sign.
Architecture diagrams, contracts, audit letters, insurance certificates. Most arrive within a business day; the few under NDA need a one-page MNDA first.
Found something? Tell us.
Coordinated disclosure. We respond within one business day, triage within three, and credit researchers in the changelog when the fix ships.
Your security review starts with a short list of questions.
Architecture, MSA, DPA, SOC 2 letter, COI. On the table before you sign.
Find out what your data has been hiding.
Tell us about your operation. We’ll show you the problems Ward catches, and the ones your current tools miss.