# Nirmata AIControls Documentation

> Nirmata AIControls is a governance layer for AI coding tools and AI agents. It sits between developers and their AI tools (Claude Code, Cursor, Codex, Copilot) and in front of AI agent infrastructure, intercepting every LLM call and MCP tool call to enforce CEL policies, budget limits, content safety rules, and audit logging — without changing how developers or agents work.

## Getting Started

- [Overview](https://docs.aicontrols.dev/docs): What AIControls is, key capabilities, and how it works
- [Getting Started](https://docs.aicontrols.dev/docs/getting-started): Choose your deployment — cloud-hosted SaaS or self-hosted Kubernetes
- [Cloud Hosted / SaaS](https://docs.aicontrols.dev/docs/getting-started/cloud): Connect your team to your AIControls workspace — choose onboarding wizard or manual setup
- [Prerequisites](https://docs.aicontrols.dev/docs/getting-started/prerequisites): What you need before starting — LLM provider credentials, permissions, workspace access
- [Onboarding Wizard](https://docs.aicontrols.dev/docs/getting-started/wizard): Fastest path — connect your LLM provider and AI tools in minutes
- [Manual Setup](https://docs.aicontrols.dev/docs/getting-started/manual): Step-by-step — provider, mode, upstream, access token, and tool configuration
- [Self-Hosted Kubernetes: Getting Started](https://docs.aicontrols.dev/docs/self-hosted-k8s/getting-started): Install AIControls into your own Kubernetes cluster using the published Helm chart

## Connecting AI Tools

- [Claude Code](https://docs.aicontrols.dev/docs/tasks/connect-claude-code): Connect Claude Code in proxy or passthrough mode — full governance on every API call and MCP tool invocation
- [Cursor](https://docs.aicontrols.dev/docs/tasks/connect-cursor): Connect Cursor — all AI features governed through the workspace proxy, UI-only configuration
- [OpenAI Codex](https://docs.aicontrols.dev/docs/tasks/connect-codex): Connect OpenAI Codex CLI in proxy (API key) or passthrough (ChatGPT OAuth) mode
- [GitHub Copilot](https://docs.aicontrols.dev/docs/tasks/connect-copilot): Govern GitHub Copilot traffic using the AIControls VS Code extension

## Concepts

- [Upstreams](https://docs.aicontrols.dev/docs/concepts/upstreams): How AIControls routes requests to Anthropic, OpenAI, Azure OpenAI, and Amazon Bedrock
- [Identities & Risk](https://docs.aicontrols.dev/docs/concepts/identities-and-risk): Who is using AI in your organization — developers, agents, and their risk profiles
- [Sessions](https://docs.aicontrols.dev/docs/concepts/sessions): Active and historical AI coding sessions — cost, duration, tools used, governance decisions
- [Audit Log](https://docs.aicontrols.dev/docs/concepts/audit-log): Tamper-evident record of every AI tool call and LLM request, with decisions and identity attribution
- [Cost Governance](https://docs.aicontrols.dev/docs/concepts/cost-governance): How budgets, rules, limits, alerts, and context optimization work together to control AI spend
- [Security Posture](https://docs.aicontrols.dev/docs/concepts/security-posture): Org-wide risk summary, compliance mapping, exceptions, and human-in-the-loop approvals
- [Detections](https://docs.aicontrols.dev/docs/concepts/detections): Session anomaly detection and baseline alerts — thresholds, auto-pause, alert inbox
- [Compliance](https://docs.aicontrols.dev/docs/concepts/compliance): Map your configuration to the NIST AI Risk Management Framework and generate audit-ready reports
- [Policies](https://docs.aicontrols.dev/docs/concepts/policies): CEL-based policies — anatomy, enforcement modes (Deny/Warn/Audit/require-approval), context fields, examples
- [MCP Governance](https://docs.aicontrols.dev/docs/concepts/mcp-governance): How MCP tool-call proxying, logging, and authorization work
- [Builder Portal](https://docs.aicontrols.dev/docs/concepts/builder-portal): Developer self-service — budgets, efficiency scores, access tokens, sessions; no admin access required

## Tasks

- [Configure an Upstream](https://docs.aicontrols.dev/docs/tasks/configure-an-upstream): Add and route to an LLM provider — Anthropic, OpenAI, Azure OpenAI, or Amazon Bedrock
- [Write a Policy](https://docs.aicontrols.dev/docs/tasks/write-a-policy): Worked examples for writing, testing, and deploying CEL policies
- [Set a Budget](https://docs.aicontrols.dev/docs/tasks/set-a-budget): Create a budget rule, set a session limit, and configure spend alerts
- [Optimize Cost](https://docs.aicontrols.dev/docs/tasks/optimize-cost): Enable context optimization and compression to reduce token usage, and track the savings
- [Configure Detection Thresholds](https://docs.aicontrols.dev/docs/tasks/configure-detection-thresholds): Tune anomaly detection thresholds and configure alert delivery
- [Generate a Compliance Report](https://docs.aicontrols.dev/docs/tasks/generate-a-compliance-report): Close compliance gaps and export a coverage report for audits
- [Connect an MCP Server](https://docs.aicontrols.dev/docs/tasks/connect-an-mcp-server): Register and authenticate an MCP server with AIControls
- [Manage Builder Portal Access](https://docs.aicontrols.dev/docs/tasks/manage-builder-portal-access): Sign in, create and revoke access tokens, connect AI tools, request policy exceptions

## Integrations

- [Generic Webhook](https://docs.aicontrols.dev/docs/tasks/configure-webhook): Send audit events and alerts to any HTTP endpoint
- [Slack](https://docs.aicontrols.dev/docs/tasks/configure-slack): Send alerts, policy denials, and HITL approval requests to Slack channels
- [Microsoft Teams](https://docs.aicontrols.dev/docs/tasks/configure-teams): Send alerts and HITL approval requests to Microsoft Teams channels
- [S3 / Object Store](https://docs.aicontrols.dev/docs/tasks/configure-s3): Stream audit logs to S3-compatible storage for long-term retention and SIEM ingestion

## Reference

- [Policy Context](https://docs.aicontrols.dev/docs/reference/policy-context): Every field available to CEL policy expressions, plus the built-in policy library
- [Decision Types](https://docs.aicontrols.dev/docs/reference/decision-types): The full set of governance decisions that can appear in the Audit Log
- [Admin MCP Server](https://docs.aicontrols.dev/docs/reference/admin-mcp-server): Tools exposed by the admin MCP server
- [Compliance Controls](https://docs.aicontrols.dev/docs/reference/compliance-controls): NIST AI RMF control categories assessed by AIControls, and what is checked in each

## Optional

- [llms-full.txt](https://docs.aicontrols.dev/llms-full.txt): Full content of all docs pages in a single Markdown file — recommended for IDE agents and RAG ingestion