Request a Merlin Demonstration
Microsoft 365
SharePoint
Entra ID
Built to Be Audited
Sprinklenet builds the AI governance program into daily operations: each policy tied to a control that runs in a tool your staff already uses, and each control leaving a record an auditor can inspect. End users ask a question and receive a cited answer, and traceability and auditability come with every request. Press the button and watch the chain break.
A Governance Program Built Into Daily Operations
The program gives you one record of every AI system in use, one way to approve a new one, a method for rating its risk, and evidence that each system still performs as intended. It covers intake, the AI use case inventory, risk rating, release checks, monitoring, and training, and it runs inside your existing systems. It maps to the NIST AI Risk Management Framework and OMB M-25-21, including the minimum risk management practices for high-impact AI.
Merlin
Merlin is the governance program as software. It holds the inventory, gates each release on required checks, rates each system's risk, and records every decision in an append-only trail with a SHA-256 hash chain that can be verified at any time. It connects to the platforms a governance program already runs.
Eight Controls, Enforced in Production
We translate the policies your leadership approves into controls that run in Knowledge Spaces or in your existing systems, and each control writes a record.
Answers come from approved sources only
Retrieval grounding scoped to each bot, with a citation on every answer.
Access follows role
Four-tier roles scoped per Space and per bot, behind multi-factor authentication, SAML 2.0 SSO, and PIV, CAC, and PKI support.
Personal identifiers are masked or blocked as policy requires
PII handling and a credential disclosure trigger in the guardrail engine, with responders notified.
Injected instructions are refused
Prompt-injection defense, with each attempt logged as an escalation event.
A person approves consequential actions
Approval steps on agent actions, with the approver, the time, and the evidence written to the record.
Changes to behavior are reviewed before release
Versioned prompts, with scored evaluation runs on every bot.
Every call is recorded
More than 40 event types, per-bot conversation history, and records you can export.
Models follow policy
Each model is chosen per workload from commercial families and hosted open models, with your own keys or through Sprinklenet's managed service.
Evaluation Before Release
Scored evaluation runs test accuracy, citation quality, hallucinations, and bias against your own benchmarks before release, and drift monitoring continues in production. Each synthetic collection is generated with a ground-truth record, so accuracy, citation, and refusal behavior are scored against facts, and no sensitive record leaves the organization's control during the evaluation.
The Audit Trail
ActorActionResourceStatusTime
Reviewer 03Session StartedSupplier Renewal ReviewSuccess09:31
Reviewer 03Source RetrievedSupplier Policy, Section 4.2Success09:31
Policy AssistantAnswer ReturnedSupplier Renewal ReviewCited09:32
Guardrail EngineEscalation RaisedPersonal Identifier PatternNotified09:34
Admin 01Records ExportedQ3 Conversation ArchiveSuccess10:05
Every call writes a record with the actor, the action, the resource, the status, and the time, chained by hash to the record before it, and each answer records the provider and model version that produced it. Applications add their own: Merlin's hash-chained evidence trail and MASTYF's hashed exports are two of them.
Platform, Deployment, and Customer Controls
Every deployment assigns all three sets of controls before sensitive data moves. Sprinklenet prepares the documentation and continuous monitoring evidence your authorizing official needs for an Authority to Operate.
- Platform ControlsOrganization tenancy, role scoping, scoped API keys, model selection, versioned prompts, activity logging, and exportable records.
- Deployment ControlsMasking, tokenization, Business Associate Agreement terms, no-retention model terms, dedicated infrastructure, and customer-specific retention.
- Customer ControlsPermitted purpose, workforce policy, legal basis, approval workflows, downstream use, and the final compliance program.
Related Reading
Start With the AI Already in Use
The review is a gap assessment against the NIST AI Risk Management Framework and a sequenced plan, for an organization with AI in use and no single record or method for oversight. Send a description of the AI in use and who owns it.