Opal gives enterprise teams the controls, visibility, and enforcement they need to deploy AI confidently — with role-based access, version-controlled resources, AI-specific safety enforcement, and a full audit trail baked into the platform from day one.
The controls that worked for traditional software do not fully cover systems that reason, respond, and act on unstructured content.
Enterprise AI needs access, enforcement, and evidence — by default.
As teams deploy more agents and workflows, managing who can access what — and making sure access stays appropriate as roles change — requires structure, not trust.
Unlike traditional software, AI systems can receive and return unexpected content. Sensitive data in responses, policy violations in outputs, and prompt injection attempts are real risks without specific enforcement controls.
When configurations, resources, and agent behaviors change without a record, it is impossible to understand what happened, why, or how to reverse it. Auditability is not optional.
Certifications, data residency requirements, and regulatory obligations require documented controls — not assurances. Enterprise buyers need verifiable evidence, not marketing claims.
Opal's governance and security posture is not a set of add-on features — it is embedded in the structure of the platform. Every resource has permissions. Every change has a version. Every interaction has a record.
Role-based access control, Single Sign-On (SSO), and team-based organization ensure that the right people access the right resources — and that access can be managed, audited, and updated as teams evolve.
Guardrails enforce input and output policies at the agent level — blocking, rewriting, or logging content that violates policy before it reaches users or leaves the platform.
Version control, publishing workflows, and activity logging give organizations a documented record of every resource and every change — at any scale.
Zero data retention eliminates storage of prompts and responses on model provider infrastructure when supported models are used. Your data stays yours.
Permissions govern access to every resource in Opal — Agents, Flows, Tasks, Knowledge files, Guardrails, Skills, Connectors, Variables, and more. Access is set at the resource level, so administrators control who can view, edit, use, and manage each asset individually.
Integrate Opal with your existing identity provider. SSO simplifies access management, enforces your organization's authentication policies, and reduces credential overhead for large teams.
Organize members into teams that reflect your organizational structure. Use teams to manage access at group scale — assign permissions to a team rather than managing each individual member.
Administrators manage model availability, platform configuration, and org-wide defaults from a central administration layer — keeping the platform aligned with internal standards.
Guardrails apply input and output policies to every agent interaction. They run automatically — before content reaches the agent and before responses reach users — with no gaps based on volume or timing.
Block or handle content that should not reach an agent. Protect against prompt injection attacks, flag harmful inputs, and prevent unauthorized data from entering agent workflows.
Prevent sensitive information from appearing in agent responses. Automatically detect and handle PII, confidential data, and policy-violating content before it is delivered.
Fast, deterministic detection for known terms, phrases, and patterns.
AI-powered detection that identifies problematic content by meaning — not just exact phrases — handling paraphrasing and novel phrasing.
Structured pattern matching for specific formats like account numbers, document identifiers, and structured data types.
Prevent the content from proceeding. The interaction stops.
Automatically modify the content to remove or redact the flagged portion.
Record the event for audit and review without interrupting the interaction.
Alert the user that flagged content was detected while allowing the interaction to continue.
Create a Guardrail once and attach it to any number of agents. Update it in one place and the change applies everywhere it is used — no per-agent maintenance.
Every resource on Opal is permissioned, including Agents, Flows, Tasks, Knowledge, Skills, Guardrails, Connectors, and Variables. Roles determine who can view, edit, publish, and administer, so the right people reach the right resources.
SSO integrates authentication at the organization level, so access follows your existing identity provider and offboarding happens in one place.
Guardrails apply to Agents and Agent Templates, enforcing input and output policy on every interaction by blocking, rewriting, warning, or logging before content reaches users or leaves the platform.
Every resource on Opal is versioned. Changes are tracked across a clear history so teams can understand what changed, when it changed, and by whom.
Resources are edited in draft. Changes are reviewed and approved before they go live. Published versions remain stable and available while drafts are in progress, so teams can develop and test without disrupting active work.
A comprehensive log records all activity across the organization, including resource creation, edits, configuration changes, access events, and agent interactions. The Activity Log provides the documented audit trail compliance and security teams require.
Every resource on Opal tracks its dependencies. Before changing an agent, a model, a guardrail, or a knowledge file, teams can see what depends on it, preventing unintended downstream impact and making change management informed.
Apply custom tags to resources for organization, discoverability, and cross-resource management at scale.
API keys, tokens, and configuration values are stored as named, permissioned secrets. Sensitive values are referenced by name and never exposed in the interface after saving.
For supported models and providers, zero data retention is applied automatically, so prompts and responses are not stored on model provider infrastructure. No additional configuration is required.
When you use a model and provider that supports zero data retention, Opal enables it automatically. Prompts and responses are not stored on model provider infrastructure for eligible models. No additional configuration is required.
Variables allow teams to store API keys, tokens, and configuration values as named, permissioned secrets. Sensitive values are never exposed in the interface after saving — they are referenced by name and used in configuration without being visible.
Connectors can be configured with per-user authorization, ensuring that each team member's credentials are used for their own interactions — not a shared service account.
Opal is designed to meet the requirements of enterprise compliance frameworks.
Information security management. ISO 27001 certification is underway.
AI management system. ISO 42001 certification is underway.
Security, availability, and confidentiality. SOC 2 Type II certification is underway.
ISO 27001, ISO 42001, and SOC 2 Type II certifications are underway.
Deploy Opal knowing every agent interaction is governed, every credential is managed, and every change is logged. Use RBAC, SSO, and the Activity Log to maintain visibility and control.
Enforce AI policy through Guardrails, document compliance posture through the Activity Log, and demonstrate controls through version-tracked resources. Governance is not bolted on — it is built in.
Manage access, configure org-level settings, control model availability, and maintain oversight of everything running in the platform from a central administrative layer.
Evaluate Opal against your security requirements with confidence. RBAC, ZDR, SSO, Guardrails, and in-progress certifications address the controls enterprise procurement teams require.
Controls that do their job without slowing the work down.
A financial services organization deploys a customer-facing agent to assist with account inquiries. Guardrails with semantic classification and regex patterns prevent account numbers and PII from appearing in agent responses. The Activity Log records every interaction for audit purposes. ZDR is enabled automatically because the selected model supports it.
A compliance team updates the organization's approved response language for a regulatory change. Using the publishing workflow, they edit the relevant Guardrails and Knowledge resources in draft, review the changes with the legal team, and publish — all without interrupting the agents already running in production. The Activity Log records the review, approval, and publish events.
An IT administrator onboards a new team of forty agents across three departments. Using teams, she assigns resource-level access at the group level rather than managing each member individually. SSO ensures every new member authenticates through the organization's existing identity provider. When a team member leaves, access is revoked in one place.
