Your company already runs on AI. Nobody's watching the door.
OhKube Swift sits in the request path between your applications and every model you use, inspecting, enforcing, pricing, and recording each call before it reaches the provider. One line of configuration. No SDK rewrite.
The problem, stated plainly
Your engineers are pasting source code into chat assistants. Your applications call six different models. Your agents make tool calls in production. And nobody in the building can answer three questions your board is about to ask.
What are we sending these companies?
Most tools answer this late.
What is it costing us?
Most tools answer this approximately.
Can we prove any of it?
Most tools do not answer this at all.
A dashboard tells you a credential leaked last Tuesday. A control point refuses the request.
That single distinction is the entire design. Swift is not a reporting layer bolted onto your AI usage. It is an OpenAI- and Anthropic-compatible gateway that your traffic flows through. Change one base_url and keep your existing SDK, your existing code, your existing models. From that moment, every request is inspected for sensitive data, checked against policy, priced, attributed to a team, and committed to a tamper-evident log, before a single byte reaches the provider.
client = OpenAI(
api_key=OHKUBE_KEY,
base_url="https://swift.ohkube.com/v1",
)Observability tells you what happened. Swift decides what happens.
What it does
Adopt it in one line. Enforce from the first request.
Point your SDK at Swift and you're done. No rewrite, no wrapper library, no per-application integration project. But unlike a passive proxy, this one has teeth: DLP violations return 400, blown budgets return 402, and policy denials never reach the provider at all.
It reads the whole request, not the easy parts
Every string in the request body is walked, not just the message content. A credential buried in a tool description, a tool_call argument, a nested tool result, or a metadata field gets caught. Most scanners check the obvious fields and quietly miss everything else, which is precisely where secrets hide.
Streaming responses are enforced, not merely observed
Virtually every production client streams. Scanning a response after it is delivered means no response-side protection at all. Swift's sliding-window guard holds output back, scans it, and redacts before release, never splitting a detection across a boundary and never releasing an unscanned byte.
An audit log that can prove it wasn't edited
Every administrative action commits the hash of the record before it. Append-only is enforced by the database itself, and the chain is verified by recomputation with a live integrity banner in the UI. Delete a record, reorder two, or forge one, and the check fails loudly. This is the difference between having logs and having evidence.
Compliance evidence in one click
Fourteen controls mapped across the EU AI Act, NIST AI RMF, ISO/IEC 42001, and the OWASP LLM Top 10, generated from live platform data rather than a questionnaire filled in from memory. Each control is marked evidenced, partial, or not covered, with the reason.
A policy engine where the strictest rule always wins
Match on model, provider, endpoint, team, application, key scope, detector category, severity, or whether the request streams. The most restrictive matched effect wins regardless of rule order, so a policy added in month nine can never accidentally relax a block written in month one. A policy that fails to parse is reported, never silently ignored.
Budgets that actually stop the spend
Scope them to the organization, a team, an application, or a single key, enforced at the gateway with HTTP 402. Spend is summed from genuinely metered requests, and a scheduled checker catches a breach even when the offending team goes quiet, which is exactly the case a traffic-triggered alert always misses.
Cost attributed to whoever spent it
Every request carries a team, application, environment, and virtual key. “What does AI cost us?” stops being one invoice per vendor and becomes a per-team, per-model, per-app answer with chargeback-grade attribution.
Least privilege, for people and for machines
Six roles, enforced on every API route. Programmatic tokens carry permissions equal to the intersection of their scopes and their owner's current role, so a token can never exceed its owner, loses its access the moment they change roles or leave, and can never mint another token.
Built so the evidence survives a bad day
Metering records are fsynced to disk before the response returns and drained in the background, so a database outage loses nothing. Recovery isn't assumed, it's rehearsed by a command that restores a backup and re-verifies the audit chain end to end.
The compliance pack names its own gaps deliberately. A pack that quietly omits what it cannot prove is a pack that fails the external audit it was built to pass. Generating one is itself an audited event.
For the people who'll ask hard questions
A real control point, not a report. Sensitive data is stopped at the boundary, in both directions, including inside streamed responses.
Spend attributed to teams and applications, with hard limits that enforce rather than notify.
A tamper-evident record and framework-mapped evidence generated from live data, honest about its own limits.
One base_url. Keep your SDK. Nothing else changes.
Where Swift goes next
- Single sign-on (OIDC/SAML) and SCIM provisioning
- Approval workflows for onboarding new models and tools
- Shadow-AI discovery via browser extension and endpoint agent
- Agent and MCP tool-call safety, plus OpenTelemetry GenAI traces
- Composite risk scoring per user, application, and vendor
- Reversible tokenization as an alternative to redaction
- Contextual PII detection via a named-entity model
- Semantic caching and load balancing across providers
- Per-tenant encryption keys and BYOK
- SIEM export (Splunk, Sentinel) and Slack/Teams notification channels
You cannot govern what you cannot see, and you cannot prove what you did not record.
Swift puts a control point where your AI traffic already flows, so the answers to what left the building, what it cost, and what you can prove are the same answer, in the same place, available now rather than reconstructed later.