How it works — governance

Sixteen steps between your people and the model

Most enterprise AI tools add governance as a reporting layer: usage shows up in a dashboard after the fact. NuBench inverts that — the governance pipeline is the request path, and nothing reaches a model without passing through it.

1. Identity and tenancy

   Steps 1–3

   The request is authenticated, mapped to your organisation, and rate-limited. Role claims are re-verified here on every call — a stolen browser session cannot outrank its role.

2. Budget pre-check

   Step 4

   Before any content is inspected, the pipeline checks whether the requester’s budget scope — user, team, or organisation — permits the spend. Budgets are defined in tokens and evaluated in-line using atomic Redis counters, not reconciled overnight. Monthly and daily hard caps are configurable per cost code; exhausted budgets fail closed immediately.

3. Content inspection

   Steps 5–8

   The prompt is classified into one of four tiers (GENERAL → RESTRICTED), scanned for personal and regulated data, checked against your DLP policy — flag, redact, or block — and screened for prompt-injection patterns. Classification is enforced by a dedicated nb-classifier sidecar that runs inline on every request.

4. Routing and dispatch

   Steps 9–11

   Policy chooses the provider: Amazon Bedrock inside the AWS boundary by default, or your own OpenAI, Anthropic, or Azure OpenAI key under your data-processing terms. The budget deduction is taken, then the request goes out.

5. Response inspection

   Steps 12–14

   The response passes back through classification and DLP — governance runs in both directions — and the actual token usage reconciles the budget.

6. Evidence

   Steps 15–16

   The exchange, its classification tiers, and every policy decision along the way are written to the audit trail as hash-chained records, and usage metrics update in near real time. Auditors read the trail without the power to change anything.