Governance your risk committee can verify.
This page sets out how governance works, which frameworks we score against, and what we do not claim. Every statement here is backed by a record you can inspect.
Know where you sit, and what good looks like.
Two axes every board and insurer now asks about: how deeply you have adopted agents, and how well governed they are. Tovel scores your position from live signals. Adoption runs AT0 to AT8, governance L0 to L4.
Adoption × governance heatmap
Sample matrix · scored from live signals in your estateAdopting fast, oversight behind
Multi-agent adoption on policy-and-approval governance: deployment ahead of continuous oversight. The white outline is an illustrative position, not a population statistic.
Continuous, then adaptive
Continuous oversight first (telemetry, plan divergence, evidence), then adaptive control, out of the exposed band.
Seven frameworks. Scored against live posture.
These are the frameworks Tovel evaluates your enclaves against today. Each pack maps its controls to live posture and is re-scored as the estate changes.
OWASP LLM Top 10
Application-layer risks for LLM systems: prompt injection, sensitive-information disclosure, supply chain, excessive agency.
OWASP Agentic Security
Agent-specific threats: goal hijack, tool misuse, identity abuse, memory poisoning, cascading failures, rogue agents.
NIST AI RMF
Govern, Map, Measure, Manage: the risk-management spine most enterprise AI programmes are structured around.
ISO/IEC 42001
The certifiable backbone for an accountable AI programme.
MITRE ATLAS
Adversary tactics and techniques against ML systems, mapped to the enclave threat surface.
EU AI Act
Obligations by risk tier, relevant to any Australian enterprise operating into or from the EU.
AU AI Safety
Alignment to Australia’s AI safety guidance. Tovel scores AU AI Safety; it does not claim CPS 234 as a covered pack.
How the harness earns the posture.
Four controls do most of the work. Each one is enforced at runtime and leaves a record.
Gating
No single action holds private data, untrusted content and external communications at once without a human in the loop, or an outright block.
Agent identity control plane
Cryptographic identity per agent, with least-privilege, role-scoped access owned by a named human. Trust tiers scope what each agent may reach.
Signed evidence locker
An append-only, hash-chained record of guardrail verdicts, approvals, tool calls and checkpoint results on governed paths, exportable with its verification material.
Data and inference in your region
Governed workloads run on AWS Bedrock and AgentCore in the AWS region you choose, inside your account. Residency is confirmed per data plane and inference profile during the evaluation.
What buyers, risk teams and engineers ask first.
Short answers, each backed by a page on this site or a statement from AWS. Ask us anything not covered here in the demo.
What access do you need?
Read-only by default, least privilege, in your own account. Every write is gated to a named human.
Does our data train models?
No. Model inference runs on Amazon Bedrock. AWS states that Bedrock does not use customer prompts or completions to train foundation models and does not share them with model providers. Tovel adds nothing to that path: prompts, tool arguments and outputs are not retained by Tovel for training, and the receipt records hashes and metadata, not the payload. AWS data protection statement for Bedrock.
Which models can our agents use, and where do they run?
Governed workloads use foundation models served from Amazon Bedrock in the AWS region you choose. Tovel allow-lists models per enclave and trust tier; a model offered only through a global or cross-region inference profile is held until it is served in your region. Model choice is recorded on every run.
What happens when an agent misbehaves?
Guardrails and breakers pause or stop it, high-consequence actions wait for a human, and the whole event is sealed to the record.
How long to see the estate?
Connect sources read-only and the inventory populates from the first scan, shadow agents first. Coverage is limited to connected sources.
What does AWS do and what does Tovel add?
AWS supplies runtime, identity, gateway policy and registry. Tovel adds argument-bound approvals, versioned rules, the delivery checkpoint, the signed locker and operational ownership. The responsibility map.
What happens if Tovel is unavailable?
Agents in your account fail closed on governed actions: nothing above the risk threshold proceeds without a decision. Read paths continue by policy. Failure posture is agreed per workload in the evaluation.
What do you not claim?
No SOC 2 or ISO 27001 certification. CPS 234 is not a covered scoring pack. No prompt-injection prevention: controls trace and contain. No full containment guarantee until per-enclave egress limits and network recording ship. History-aware policy is integrated with production validation in progress, not enforcing. Named customer deployments are published only when approved.
What will a vendor security questionnaire need?
Legal entity Tovel Pty Ltd, Australia. Deployment: Tovel control plane with the enclave in your AWS account; customer-hosted control plane in build. Sub-processors: AWS (your chosen region) and Auth0 for identity. Access: read-only by default, least-privilege roles you grant, every governed write gated. Retention and export per record type, with verification material. Architecture, responsibility map and sample evidence are provided in the evaluation.
How do we leave?
Evidence exports with its verification material and stays valid without Tovel. Enclaves run in your account; offboarding removes Tovel credentials and hands over the record.
Bring your questions. We will show the record.
A 30-minute governance walkthrough: how posture is scored, the packs that matter to you, and the evidence a board can read. Scoring your own estate follows in an agreed evaluation.
