Access control that is the data path, not a policy about it.
Your problem isn't saying no to AI. It's that the business will do it anyway, on data with no access model, and the breach report will have your name on it. Forge gives you a place to say yes safely.
Start here.
Three pains, three mechanisms.
AI agents and copilots are being pointed at production data with service-account credentials.
On Forge an agent gets a session like a person: tenant-scoped by the foreign-key walk, permission-checked per operation, audited per action, revocable instantly. Prompt injection can change what an agent asks for. It can't change what the data path returns.
AI on governed data →Multi-tenant isolation depends on developers never forgetting a filter.
Isolation is computed from the schema and applied in one no-ORM data path with no bypass. Deny by default, fail closed, column-level gates, injection scrubbing, and an audited justification required for the one deliberate escape hatch.
The security engine →Every audit is archaeology across systems that log differently or not at all.
Governed tables are system-versioned at the database engine, sessions are server-side and revocable, login attempts are audited, and multi-table saves carry correlation IDs. The answers to who, what, when, and could-they are queries, not investigations.
Operations, identity, and audit →Straight answers.
In your SQL Server, on your infrastructure or in your own cloud account under the managed offering. We don't operate a shared multi-tenant SaaS, on purpose.
Generated rules compile into a hard sandbox: no database, file, network, or reflection access, allow-listed namespaces, per-rule time budgets. Publishing is blocked while tests fail, publishing rights are a separate permission, and published code is immutable.
SOC 2 is on the roadmap, not in hand, and we'll tell you that before you ask. What we have today is an architecture built for your review: one data path, deny by default, engine-level history. Bring your hardest reviewer to the assessment.
Yes. Sessions are server-side. Revocation is immediate and covers every tenant membership, human or agent.
Bring your hardest security reviewer.
The assessment runs on your schema, with your rules. If the architecture doesn't hold up under questioning, better to know in week one.