Governed automation, enforced by the platform.
Models propose actions. Boundlane decides what runs: under your policy, inside your tenant, with a record of every decision. Software that reads supplier email and touches a ledger will meet text written to manipulate it. The defence is that the prompt never decides.
Boundlane Gateway holds the assistants your people use on your business systems to the same rule.
Every action is checked against your policy outside the model. A prompt cannot authorise anything.
Your data and credentials are scoped to your organisation, enforced by the database itself.
A consequential action, or an amount above your limit, waits for a person with the right role. The approval covers that one action.
Every decision and every effect is recorded on a chain that shows if anyone alters it.
Your administrators decide what never runs.
We recommend a list of actions no automation should take, and your administrators decide the final list. A forbidden action is refused in every stage and cannot be approved through. Adding one stops it in every live automation at once. An action is recognised by what it does, including the operation it calls in your system, not only by its name, so a tool that updates a supplier’s bank account is refused as a change of bank details.
Deleting the audit log and switching off a control are forbidden in every workspace, because they would disable the enforcement itself. Every change to the list records who made it and why. A refused attempt opens an exception in your inbox, so a blocked action leaves evidence rather than silence.
Above your limit, a person decides.
Set an amount per currency and the role that approves above it. A payment over the limit waits for that person, and the steps that depend on it wait too, so nothing is marked paid ahead of the payment. An amount that cannot be read counts as over the limit.
Before you save a change, preview it against your recent runs: which payments it would have held, which it would have released, and which payments no limit reaches.
- Per currency, per role
A limit for each currency you pay in, and the business role that may decide above it.
- One decision, one payment
An approval releases the exact payment it was shown, once. It does not open the door for the next one.
- Visible before it bites
Settings show which payment actions each live automation has and which limits cover them.
Nothing reaches production on day one.
Every automation starts in rehearsal: it reads your real systems, records what it would have changed, and changes nothing. Each wider stage is a decision someone makes on the evidence of the runs so far, and you can step back at any time.
| Stage | Changes it makes in your systems |
|---|---|
| Rehearsal | None. Every write is recorded and nothing is changed. |
| Parallel | Low-risk writes |
| Limited | Low- and medium-risk writes |
| Live | Low-, medium- and high-risk writes |
Any agent can propose. Your policy still decides.
AI assistants connect over the Model Context Protocol, through a sign-in that a person grants and can revoke. They act inside the same policy as everything else, and an action that needs approval waits for a person in Boundlane.
How assistants connect- Access is granted per workspace and per scope: read, operate or build.
- An assistant can draft an automation. Releasing it and widening its rollout stay with people in Boundlane.
- An assistant can propose an action instead of taking it, and the proposal waits for approval.
- Every call is recorded with the assistant that made it.
- Disconnect an assistant from settings, and its access stops at once.
What a security review asks about
Row-level security on every table that holds your data, enforced by the database rather than by application code remembering to filter.
- On Business and Enterprise, your data can have a dedicated database
- A dedicated database that cannot be reached is never replaced by the shared one
Single sign-on through your own identity provider with OIDC, set up from your settings, or SAML by arrangement, and SCIM 2.0 for provisioning and removal.
- SAML assertions are read from the signed content, and a replayed assertion is refused
- Removing someone in your directory removes their access here
A consequential action waits for someone who holds the reviewing role in your organisation, not for whoever has an admin account.
- Only one decision counts, even when two reviewers act at once
- You can require that the person who started a run cannot approve it
- The approval behind each action is named in the record
Each entry is chained to the one before it, so an alteration shows rather than hides.
- Every change is recorded, refusals included
- Role changes record who granted what, and what the person held before
- Changing any entry breaks the chain from that point on
Encrypted at rest and opened only at the moment of a call to your system. Nobody can read one back out, including the automation.
- The master key can live in AWS KMS or Google Cloud KMS
- Credentials never enter a conversation with a model
Each connection reaches only the destinations you approve, checked on every request and every redirect.
- Private network and cloud metadata addresses are refused
- An installed template never inherits its publisher’s destinations
Model calls go through a zero-retention gateway. Personal data is redacted when a run is recorded, not only when it is displayed.
- Boundlane AG is based in Switzerland
- A published data processing agreement, subprocessor register and retention schedule
Most automations run no custom code. When one does, it runs in an isolated sandbox with no network, files or credentials of its own.
- It can act only through the actions the automation declares, under the same policy
- It is fixed at release and refused if it changes afterwards
Answers your auditor can check.
Ask who can approve a payment, or what an automation did last Tuesday and on whose authority, and the answer comes from the record itself, with a way to verify that the record has not been edited.
For every run: each action, whether it was performed, recorded or refused, and the authority for it, whether a rollout stage, a named approver or a rule. Printable, with a fingerprint so two copies can be compared.
The current roster, every grant and removal that led to it, and a check that the history behind it is intact.
What each live automation may do right now: what it changes, what it only records, what waits for a person and what is forbidden.
Before a policy change is saved, its effect on recent runs: what would now be refused, held or released.
A single download of your controls and their configuration, assembled from the running system for your auditor.
Your people’s own assistants, on your business systems
Gateway lets each person use the assistant they already have on your business systems. One engine governs every system: each person’s own credential, role-based policy, approvals bound to the exact change, a hash-chained audit trail and entitlement reports. A connector adapts it to each system, and a connector cell for your company holds each person’s credential, applies your policy and calls the system.
Each person connects their own account for each system once. The cell calls the system with that credential, so the system’s own permissions apply, and the effective right is the intersection of those permissions and your policy.
- The cell checks that the identity matches the person’s email, and that the sign-in finishes in the browser that started it
- The person’s credential never leaves the cell, and their assistant’s token never reaches it
Access groups map to Boundlane business roles, and every grant is explicit. Each connector adds the limits its system needs.
- Removing a person’s Boundlane role removes their access on the next call
An agent can only propose a change. A different person who holds an approver role decides it in Boundlane Approvals, and the decision is bound to that exact proposal by its fingerprint.
- The requester executes the approved change once
Each cell keeps a hash-chained audit log of every call, and Boundlane records its head in your tenant’s own audit chain at least every 30 minutes, so a rewrite of either is detectable.
- Cell archives are configured with S3 Object Lock in compliance mode
- An entitlement report shows what each group and person could do under any past policy revision
Each connector cell is a separate deployment for one customer, in AWS in the EU (Stockholm, eu-north-1) by default. Boundlane signs a short-lived context token, valid for at most five minutes, for every call to it.
- No language model sits in the cell’s data path: discovery and policy use rules, not a second AI provider
- Tool results pass through Boundlane’s MCP front door, which runs with the providers and in the locations on the Subprocessors page
Each Oracle operation is granted with explicit fields, business units, legal entities and ledgers, finders, page sizes and daily row allowances.
- The scope is sent to Oracle with the query, and every returned row is checked again
- Payment, bank, payroll and approval operations are blocked
- Audit records hold identifiers, decisions and hashes, never Oracle row data
Oracle’s record version is checked before a change applies, and the record is read back afterwards.
- On a live Oracle test environment, Oracle refused a change sent with a stale version and changed nothing
- An uncertain outcome is never retried; the record is read back to tell the person what happened
- The cell uses only Oracle’s published REST APIs and pauses when Oracle asks it to slow down
For a business system that publishes a remote MCP server, each person signs in to the system with OAuth, and each tool is granted to a role with argument limits.
- Changes go through the same approvals, bound to the exact change
- Every call lands in the same audit chain
The first certified connector. Each operation it enables passes Boundlane’s activation gate, with a reviewed usage contract and probe evidence from a live Oracle Fusion test environment no older than 30 days. The contracts are re-certified after each of Oracle’s quarterly releases.
Governs any business system that publishes a remote MCP server. As of 6 November 2026 it is proven end to end against a reference system in Boundlane’s test harness, and not yet certified with a specific vendor’s server.
Most of these controls run in the connector cell, so each connector carries its own evidence. More certified connectors follow design partner demand.
Bring your security questionnaire.
We would rather answer it before you sign. Our data processing agreement, subprocessor register and retention schedule are public.