Provider & connector governance
Models and tools only act through registered, evaluated, credentialed entries. Everything below is a governed mock — no provider is ever called.
Model Provider Registry
Every provider carries a trust evaluation, credential posture, allowed domains, an effect-class ceiling, a data boundary and a logging mode.
Open registry →Connector Registry
Twelve connector types — model providers, agent runtimes, tools, vector stores, browser automation, CI/CD and domain rails — each with an effect ceiling.
Open registry →Credential Vault (mock)
Status metadata only: present, rotation due, expired or missing. Expired or missing credentials make provider bindings fail closed. No secret values exist.
Open vault →Model onboarding flow
Select provider type, deployment mode, domains, effect ceiling and data boundary — a mock trust evaluation produces an evidence capsule and a live registry entry.
Onboard a provider →Verification Workbench
Verify simulated model answers and proposed agent actions against mock evidence — claims, contradictions and trust decisions, all sandbox-only.
Verify a model answer →Provider families in the sandbox registry
Hugging Face
Open-weights models and embeddings, governed via mock hub entries.
AWS Bedrock
Managed foundation models behind domain scopes and effect ceilings.
AWS SageMaker
Custom fine-tuned endpoints with credential rotation posture.
NVIDIA NIM
Self-hosted inference microservices under sandbox data boundaries.
Self-hosted open source
On-prem open-weights models with full-audit logging modes.
Enterprise model gateways
Multi-provider routing gateways — highest risk tier, tightest gates.
No real provider connections. No API keys, no inference, no external calls. Every registry entry, endpoint label and credential status is simulated.