In beta · status as at 6 November 2026
In many organisations the AI-use policy is a document that nothing enforces. Kovac checks requests to your data against your policy before they reach it, and records what it refuses: on three of seven routes to data today, all seven by the end of November 2026. Below: the problem, what changes, and what you get, each with where it stands today. Further down, the mechanism, for architects.
The problem
People, AI tools and scripts reach your data directly. The rules for what AI may see sit in a policy document, and nothing in the path checks them. So when a client, the board or an auditor asks, nobody can show what AI was stopped from seeing. Kovac records refusals today, on the routes it checks; recording permitted requests follows by the end of November 2026.
Before
The solution
The same picture, with one change: Kovac sits between the requests and your data, checks requests against your policy before they reach the data, and records what it refuses.
Today that check runs on three of the seven routes to data: object, action and deploy requests. All seven routes to data checked against your policy by the end of November 2026. Requests come from people and from pipelines built on Kovac. From late November 2026, in pilots, AI models connect through Kovac's check. Kovac does not sit in front of Microsoft Copilot, Gemini for Google Workspace or web chat assistants.
After
Representative, not a product screenshot.
Kovac holds the data you load into it, with the columns you mark sensitive. People and pipelines built on Kovac ask for that data through Kovac, which checks their requests against your policy before they reach it.
Some reads do not go through the check yet, and the picture shows them dashed: people opening raw files or previews, and code run directly. All are checked by the end of November 2026.
Where a step does less today than its name suggests, the line under it says so, and gives the month.
From a person or a pipeline built on Kovac.
Identity, role, policy and permitted data.
What may run.
Today a deploy is signed after it runs, a plan the kernel cannot sign runs unsigned, and the signature covers id, intent and code hash. Nothing runs unsigned by the end of November 2026. By March 2027, every plan is signed in full before it runs.
Designed to run only inside the plan.
Engine verifies the plan by March 2027.
A trail you can search.
Every entry signed as it is written, permitted requests and refusals, by the end of November 2026.
Checked against policy today for object, action and deploy requests. All seven routes to data checked against your policy by the end of November 2026.
What you get
Each card says what is true today and the month for the rest. Status as at 6 November 2026.
TodayRefusals on the routes Kovac checks are kept in a searchable record. Permitted requests are not recorded yet, and the record is not signed.
By whenBy the end of November 2026, only Kovac itself can write to the record; by then, every entry is signed and linked to the one before it as it is written, permitted requests as well as refusals.
TodayFields you mark sensitive are masked with placeholders before Kovac passes them to an AI model or posts them to another system.
By whenIn a pilot, from late November 2026, Kovac is model-agnostic: you choose the AI model, a hosted one or your own on your own network. Fields you mark sensitive reach it masked with placeholders; fields you don't mark reach it as they are.
TodayA request is checked against your policy before it reaches the data, on three of seven routes to data today.
By whenAll seven routes to data checked against your policy by the end of November 2026.
TodayColumn clearances are enforced on record reads in Kovac today; not yet on raw files or previews.
By whenClearances enforced on every read by the end of November 2026, and carried through pipeline transformations, computed server-side, by March 2027.
The free Scoping Review, with both founders: which route to data your refusal sits on, and whether that path is checked yet. Or write it first, in two minutes, on the pilot page.
For technical readers
Kovac checks a request against your policy before it reaches the data, has the kernel sign the plan that answers it, and records the outcome. On some paths that is true today; the rest carries a month. What follows says which, part by part, for architects and IT.
Each part, today and by when ↓Each part, today and by when
The same dated commitments as our security page, where the controls are set out row by row for IT and legal. Where the controls actually are →
You model your organisation at the level of meaning. A dataset can be promoted to an Object Type – a typed semantic object whose column markings are enforced when it is read. Object Types are what the rest of the platform reads, and what an AI tool connected to Kovac will read.
The policy core is pure, property-tested logic over identity, ontology and request. Object, action and deploy requests are checked against your policy today – three of seven routes to data – and most of that gating runs in the Go services, not the kernel. Three failure cases still proceed today when they should stop: a deploy on a policy error, an object read on a lookup error, and a plan that cannot be signed. Column clearances are enforced on record reads in Kovac (object reads); not yet on raw files or previews. Access control is policy-as-code and a permission graph, with time-boxed grants whose expiry is enforced; a grant is scoped per marking rather than per dataset, and by the end of November 2026 only your administrator or your Data Officer can issue or revoke one.
By whenEvery path to data goes through policy by the end of November 2026. Every route blocks a request when the policy check cannot run, by the end of November 2026. Clearances enforced on every read by the end of November 2026, and carried through pipeline transformations, computed server-side, by March 2027.
When the kernel is reachable, it signs plans, actions and grants with Ed25519. The kernel holds the signing key, so only the kernel can produce a valid signature; nothing verifies one yet. The signature covers the plan's id, intent and code hash – not its inputs and outputs. If the kernel is unreachable, the plan proceeds unsigned. A deploy is signed after it runs.
By whenNothing runs unsigned by the end of November 2026. Every plan signed before it runs, covering its inputs, outputs and permitted operations, and verified by the engine that runs it, by March 2027.
Refusals on the routes Kovac checks are kept in a searchable record. Permitted requests are not recorded yet, and the record is not signed. Any signed-in user can add an entry today, so by our own guide's test the trail is a log. An approval is recorded against a plan, but not required: the plan does not wait for the approval before it runs. Ontology changes are versioned today.
By whenBy the end of November 2026, only Kovac itself can write to the record; by then, every entry is signed and linked to the one before it as it is written, permitted requests as well as refusals. Reconstructing the governed state at any past moment – ontology, policy and lineage – is on the roadmap, not dated yet.
The kernel holds the policy core and the signing key. AI and orchestration are designed to run as a governed client, with no special trust and with retrieval outside the kernel boundary. Kovac is designed to govern what runs, not how: it sits beside your warehouse and compute rather than replacing them. PostgreSQL and MySQL connect today, for schema discovery, and pipelines run on file data. Fields you mark sensitive are masked with placeholders before Kovac passes them to an AI model or posts them to another system.
By whenReading straight from your database tables by December 2026.
What a pilot would do for your team: Bids and work-winning, finance, sales and account management, marketing, groups and private equity, risk and audit and IT, security and AI leads.
Where Kovac is heading
Kovac is in beta. Two of these work today; the rest are in development, and those with a date give it. Each line comes with its limit written down, because that is the test we would ask you to put to any vendor.
On the three routes it checks, Kovac records each request it refuses: who asked, for what, and what access was missing.
LimitToday any signed-in user can add an entry in anyone's name. By the end of November 2026, only Kovac can.
On the three routes to data Kovac checks today, one small, tested piece of code decides each request the same way.
LimitThree failure cases still let a request through: a deploy whose policy call fails, a read of a record whose clearance lookup errors, and a plan that cannot be signed. Every route blocks a request when the policy check cannot run, by the end of November 2026. All seven routes to data checked against your policy by the end of November 2026.
Only Kovac will write to it: every entry signed and linked to the one before, permitted requests as well as refusals.
By whenBy the end of November 2026, only Kovac itself can write to the record; by then, every entry is signed and linked to the one before it as it is written, permitted requests as well as refusals.
LimitA change to the record is detectable, not prevented.
Every AI call, and every read by an assistant connected to Kovac, will be recorded before data moves: who asked, which columns went or were held back. AI tools that never connect are not.
LimitNo record, no call. Once data reaches a connected assistant, what it does next is not recorded. Text from Word and PDF documents is sent as written.
AI models will work on your data through Kovac's check, with the columns you mark as sensitive masked before each call.
LimitMasking works on the columns you mark, not the text of a Word or PDF document.
An AI assistant you connect to Kovac will get its own login, with no more access than the person who owns it, and can be revoked at any time.
LimitNo AI assistant has been connected yet. Once data reaches an assistant, Kovac records who read it but cannot control where it goes.
A supplier's AI will be refused anything your IT team hasn't cleared, told why, and unable to widen its own access.
LimitShown in a demonstration; sign-in and the AI model have been tested against stand-ins only.
AI will draft steps, measures and alerts from your data's layout, without seeing a single figure.
LimitTested with a stand-in model only.
Connections to SharePoint and OneDrive, then Google Workspace, Xero and Sage, will apply the markings you choose to what they bring in.
By whenSharePoint and OneDrive, with Microsoft Entra ID sign-in, are in alpha testing. Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in, by November 2026. Xero and Sage by November 2026. Reading straight from your database tables, Microsoft Dynamics and HiBob by December 2026.
LimitSo far the connectors have run against simulated systems only. Labels set inside Microsoft 365 or Google are not read.
A first pilot deployment, in beta; then options to host in the UK or EU, on your own servers, or air-gapped.
By whenFirst pilot deployment, in beta, by the end of November 2026; UK and EU hosting, and customer-hosted and air-gapped options, by December 2026.
LimitYou choose the AI model; running it inside your own boundary has no date yet.
When you clean and combine data, marked columns will stay marked in what comes out.
By whenClearances enforced on every read by the end of November 2026, and carried through pipeline transformations, computed server-side, by March 2027.
LimitYour own SQL or Python steps will run one job at a time, up to 1 million rows.
You'll be able to start from ready-made finance dashboards and checks, and adapt them without losing your changes.
LimitOne pack exists so far: Finance.
What Kovac is not
It sits between the people and pipelines that ask for data loaded into it and the data itself, and checks their requests against your policy: on three of seven routes to data today, all seven by the end of November 2026. It does not sit in front of Microsoft Copilot, Gemini for Google Workspace or web chat assistants.
Start with the free Scoping Review. One working session with both founders. No data, nothing installed. A written pack within 48 hours of the session.
