The Enterprise AI Control Plane
MCP-native. No agents, no browser extensions, no new interfaces for your team.
An MCP gateway, with control built in
AI assistants reach business systems through MCP - the open protocol used by ChatGPT, Claude, Copilot and Mistral. Boundary is a gateway on that protocol: IT deploys it once, and every tool call from every assistant passes through it before any business data is returned. Governance - classification, tokenisation, policy, audit - runs on the gateway as modules, in the path.
AI Assistant or Agent
- Classification
- Tokenisation
- Policy
- Audit ledger
Fails closed - unknown is withheld
To your business systems - per-user OAuth
See the connector catalogue at /integrations
Protocol layer
Boundary operates at the MCP protocol layer. Every AI tool call passes through the governance layer before business data is returned. Nothing is added to the employee's workflow.
No client changes
No browser extensions. No endpoint software. No MDM requirement. Boundary is deployed once by IT and governs every subsequent interaction automatically.
Vendor-neutral
One policy, applied across every AI assistant your teams use. Employees use whatever AI tool they prefer. IT governs all of them the same way.
What happens to every request
- 01
Classified
Every field, inline, before the model sees anything.
- 02
Your policy applied
Per user, per tool, per system, per field.
- 03
The outcome enforced
AllowedTokenisedWithheld - 04
Recorded
Hash-chained, exportable for regulators and SIEM.
Boundary fails closed.
When classification cannot complete with sufficient confidence, the outcome is withholding - not pass-through. If Boundary is unavailable, AI context from business systems is withheld. There is no open fallback and no asynchronous bypass path.
Governance does not fail open.
Full Security & Architecture OverviewTokens, not redactions
Redaction makes AI safe by making it useless. Boundary replaces sensitive values with stable reference tokens the assistant can still work with - and resolves them back to real records, server-side, when the user acts.
| Field in the CRM | Classification | What the model receives |
|---|---|---|
| Deal amount - £48,000 | Tier 1 · Analytical | £48,000 - amounts, dates and statuses pass through unchanged, so analysis stays real. |
| Company name | Tier 2 · Reference | [Company #1] - a stable token. It links to the real record for authorised users, and it works in follow-up requests. |
| Contact email & phone | Tier 3 · Withheld | Nothing. Personal data never enters the model's context - there is nothing to leak. |
| Unrecognised custom field | Withheld by default | Nothing, until an operator rules on it. Unknown defaults to withheld. |
This table shows one policy, not fixed behaviour. Every field's treatment is a policy you set - per user, per tool, per system, per field, tuned to your own risk profile.
The round trip: the model never sees the name.
The work still gets done.
Ask the assistant to "draft an email to [Company #1]'s account team" and Boundary resolves the token back to the real record server-side - even when the follow-up call targets a different connected system. Writes queue for approval before anything executes.
- 01Assistant
"Draft an email to [Company #1]'s account team"
- Token resolvedserver-side, per policyWrite => approval queue
- 03Business system
Real record, real values - any connected app
- 04Response
Returns classified and tokenised - the model only ever sees tokens
Every step audited
Two ways to begin.
Proof of value
30 daysA 30-day proof of value, run with our team.
- Governed connections for one team
- Field-level classification
- Complete audit trail
- Run with our team throughout
Enterprise
TailoredSized to your organisation.
Tell us roughly how many people and applications you need governed. We will come back with a quote.
See it in action
Book a demo and we will walk you through the platform with your own data.
Book a Demo