Last verified November 3, 2026. Written by Prediction Guard, which is one of the platforms compared. Vendor capabilities change quickly, so confirm anything that matters to your decision directly with the vendor.
The Short Answer
Operational control of agents inside your boundary is available from Prediction Guard and TrueFoundry, with IBM watsonx Orchestrate worth evaluating if its required agent controls are available in your target environment. Fiddler and Lakera offer self-hostable observability or inspection capabilities, while Guardrails AI is an open-source validation component; Credo AI focuses on assessment and compliance workflows, and Microsoft Agent 365 is a hosted option. Prediction Guard delivers operational control of agents as a sovereign AI control plane that runs inside your boundary, so enforcement and evidence both stay with you.
How This Comparison Was Built
Seven criteria. Deployment model (SaaS, VPC, on-prem, air-gapped), runtime enforcement versus assessment only, agent identity and delegated authority, MCP and tool controls, token and spend enforcement, immutable audit logs and evidence inside your boundary, and compliance mappings (NIST AI RMF, EU AI Act, AIUC-1).
Three categories, defined by rules applied to every platform.
- Full control-plane candidates: documented customer-controlled deployment, runtime enforcement on live requests, and documented agent-level identity or tool authorization with audit evidence. A platform that meets these rules on paper but has an unconfirmed requirement is a conditional candidate. IBM is the one here, because on-premises availability of its agent controls is unconfirmed.
- Self-hosted inspection and observability components: documented or feasible self-hosting and runtime inspection of prompts, outputs, or tool calls, without a documented identity, authorization, and audit-control stack.
- Assessment-first or hosted platforms: assessment and compliance workflows, or control planes hosted by the vendor. Assessment-first products can be self-hosted but do not enforce at runtime, and hosted platforms do not meet the deployment requirement. Either can complement an on-prem control plane.
Evidence tags on the five criteria most often overstated (deployment and air-gapped support, agent identity and delegated authority, MCP and tool controls, token and spend enforcement, and audit evidence). Each claim in those columns carries one tag:
- [V] the vendor says so in its own materials. We did not test it.
- [R] a third-party source reports it and we did not find it in vendor materials.
- [U] unconfirmed: not documented in the sources we reviewed. That is not the same as "no."
The audit column separates two questions. Where logs are generated and retained is one; whether tamper resistance is documented is another. Hashing and WORM storage appear only as what a vendor's own materials describe [V], not as verified features.
Where the categories come from. Each rule maps to one of the seven criteria, and Prediction Guard is classified by the same rules. Classification follows documentation, not a vendor's own label, which is why Fiddler, which calls itself a control plane, appears as a component.
Documented support is not technical feasibility. An open-source library can usually run in an air-gapped environment, but that does not establish vendor support, operational maturity, or a complete audit system. The table and the Guardrails AI entry mark the difference.
Method and disclosure. Vendor documentation came first; third-party reviews were used only where vendor pages were silent, and most reviewers sell competing products, so treat [R] claims as leads to verify. Every platform gets the same template, including Prediction Guard. We did not test any product. Prediction Guard wrote this page.
Comparison Table
Related Reading by Criterion
- Runtime enforcement versus assessment only: continuous enforcement versus audits shows why point-in-time assessment and runtime enforcement produce different evidence, and gateway versus control plane separates traffic routing from policy enforcement.
- Immutable audit logs and evidence inside your boundary: audit log implementation covers what a defensible AI audit log contains and where it should be generated and retained.
- Compliance mappings (NIST AI RMF, EU AI Act, AIUC-1): NIST AI RMF mapping walks through each function, and the AI compliance evidence framework covers NIST AI 600-1, OWASP, and EU AI Act audit artifacts.
The Eight Platforms
Each entry uses the same template: what it is, its strength, the four procurement questions a financial services team should ask, and what to confirm.
Full Control-Plane Candidates
IBM is listed as a conditional candidate: it meets the rules on paper, but on-premises availability of its agent controls is unconfirmed.
1. Prediction Guard. A self-hosted AI control plane that deploys on-premises, in a VPC, hybrid, or air-gapped and enforces policy on every call inside your boundary. In Prediction Guard, Agent Behavior Controls decide at runtime which actions an agent may take, which is the line between a platform that assesses agents and one that controls them. Component Input/Output Controls cover the content of each request and response.
- Where enforcement occurs: on the live request path inside your boundary, covering prompts, responses, and tool calls.
- Identity and permissions: Prediction Guard ties each MCP connection to a named user through delegated authority, which separates an agent that is granted access from one that inherits it. Administrators set scope per registered MCP server, and token and spend enforcement sets resource limits.
- Log retention: Immutable Audit Logs are generated inside your boundary and stored by your SIEM [V], and the Evidence bundle packages the registration record, AIBOM, policy snapshot, and log export. Its own audit-log guide describes SHA-256 hashing at generation and WORM storage and says your SIEM stores the logs, but does not say whether WORM is a default or something you configure, so durability depends on your storage configuration [V].
- What you operate: the deployment itself. There is no SaaS option.
- Confirm: AIUC-1 coverage (it describes alignment and a logging evidence mapping, and does not certify). It has less model-evaluation depth than Fiddler, no assessment workflow comparable to IBM's or Credo AI's, and is a smaller vendor than IBM or Microsoft.
2. TrueFoundry. An AI gateway, an MCP gateway, and a deployment platform. Its pages describe VPC, on-premises, and air-gapped deployment with agent-level RBAC, quotas, and content checks. Strength: the closest match to Prediction Guard on deployment and spend control, plus model serving and GPU orchestration.
- Where enforcement occurs: at the gateway on the request path inside your boundary.
- Identity and permissions: RBAC and authentication and authorization for MCP servers and agents [V]. Per-user delegated authority is [U].
- Log retention: its on-prem architecture writes audit logs to a data store inside your boundary [V]. Its audit-logging docs describe platform activity logs (admin and API actions) with SIEM export [V]. TrueFoundry's pricing page puts VPC and air-gapped installs on the Enterprise plan [V]; which plan includes audit logs is [R]. A vendor blog describes immutable request logs, but the docs do not describe tamper resistance [U].
- What you operate: a Kubernetes-native platform and its data stores. Its self-hosted security docs say the control plane and gateway still exchange authentication, licensing, and telemetry with TrueFoundry's central servers [V].
- Confirm: a published NIST AI RMF, EU AI Act, or AIUC-1 mapping, how air-gapped installs handle central authentication, and that MCP controls, budgets, and audit retention all apply to the same self-hosted configuration and plan. Its center of gravity is infrastructure and routing, so an assessment workflow would sit elsewhere.
3. IBM watsonx.governance and watsonx Orchestrate (conditional candidate). watsonx.governance is a lifecycle assessment platform with EU AI Act, NIST AI RMF, and ISO 42001 accelerators. IBM's June 2026 Agentic Control Plane in watsonx Orchestrate adds policy enforcement, content checks, agent identity and access control, and cost control. Strength: deep assessment coverage plus an agent control plane in one portfolio.
- Where enforcement occurs: IBM refers to content-check capabilities within watsonx.governance [V], while third-party reviewers disagree on whether it blocks traffic inline [R]. Orchestrate enforces policy on agents [V].
- Identity and permissions: agent identity and access control in Orchestrate [V]; not documented for watsonx.governance [U].
- Log retention: audit trails and factsheets [R]. They stay inside your boundary only when IBM software runs on your infrastructure. Governance-event logging is reported as tamper-evident [R].
- What you operate: on-prem software runs on Cloud Pak for Data or IBM Software Hub, which you install and maintain [V].
- Confirm: IBM's announcement says the Agentic Control Plane is available on AWS and IBM Cloud. Confirm on-prem availability feature by feature (identity, policy enforcement, cost control), keep watsonx.governance's assessment capabilities separate from Orchestrate's runtime controls in your evaluation, and ask whether accelerators that cited SR 11-7 have been updated.
Self-Hosted Inspection and Observability Components
4. Lakera (Check Point AI Guardrails). Runtime inspection for prompts, outputs, tool calls, tool responses, and tool descriptions, plus an agent-behavior detector and a tool allow and deny list, per its agent security docs. Strength: a mature prompt-layer defense, with self-hosting through Docker, Kubernetes, or an air-gapped install for Enterprise licensees. Check Point announced the acquisition on September 16, 2025 and closed it on October 22, 2025.
- Where enforcement occurs: wherever you call its Guard API, in your application or gateway.
- Identity and permissions: not documented [U]. You supply identity and authorization.
- Log retention: self-hosting keeps data inside your boundary [V]. An audit-log feature and tamper resistance are [U].
- What you operate: the inspection containers and their integration into your applications.
- Confirm: how procurement works after the acquisition, since new sales reportedly route through Check Point [R].
5. Guardrails AI. An open-source Python framework with validators for model inputs and outputs, and a self-hosted server. Strength: flexibility for engineering teams building their own validation layer.
- Where enforcement occurs: inside your application or on a self-hosted server you run.
- Identity and permissions: not provided natively. A deployment built around the library could add identity, and native application-level tool permissions are not covered [R].
- Log retention: not provided natively. A deployment would add logging, and tamper resistance would be yours to build.
- What you operate: everything. Its hosted Hub installer and remote inference were retired in August 2026, so model-based validators run locally or on your own endpoint.
- Confirm: support status, since the table marks a supported air-gapped offering as [U]. Harvey announced the acquisition of Guardrails AI on September 9, 2026, and the open-source framework remains available. Treat the ownership change as a third-party risk item.
6. Fiddler. Agentic observability and evaluation with inline inspection, deployable in SaaS, VPC, on-premises, and air-gapped forms per its platform page. Its control plane page cites audit evidence aligned to NIST AI RMF, ISO 42001, HIPAA, NAIC, and the EU AI Act. Strength: deep monitoring, evaluation, and explainability, with financial-services customers running it in their own VPC. Fiddler calls itself a control plane; by the rules above it is a component because no agent identity, tool authorization, or spend enforcement is documented, which may reflect documentation and not the product.
- Where enforcement occurs: inline inspection on the request and response path inside your VPC or on-prem deployment.
- Identity and permissions: not documented [U].
- Log retention: audit trails [V], inside your boundary when deployed in a VPC or on-prem [V]. Tamper resistance is [U].
- What you operate: the Fiddler deployment and the in-environment models it uses.
- Confirm: MCP and tool access control, spend limits, and AIUC-1 coverage.
Assessment-First and Hosted Platforms
7. Credo AI. A governance, risk, and compliance platform with an AI registry, policy packs for the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2, and automated evidence generation. It also supports AIUC-1 and says plainly that it does not issue certification. Strength: a strong option for programs that run on workflow and evidence collection.
- Where enforcement occurs: not on the request path today. Credo AI's May 2026 GAIA announcement names production monitoring with enforcement at the point of use as the next roadmap step [V], and its Agent Governor enforces policy inside the agent harness as a research preview, not generally available, with Claude Code the only harness live today [V].
- Identity and permissions: an agent registry with agent cards [V]. Identity enforcement happens elsewhere [U].
- Log retention: evidence lives in the platform. Credo AI's self-hosting documentation describes Kubernetes installation with online and air-gapped methods [V], which some third-party reviews still describe as SaaS-only. Tamper resistance is [U].
- What you operate: if self-hosted, a Kubernetes cluster, object store, and database [V]; little if SaaS. A live control plane would still be needed.
- Confirm: when Agent Governor moves beyond research preview, and which agent harnesses it supports.
8. Microsoft Agent 365. Microsoft's control plane for agents, generally available since May 1, 2026, with a registry that can sync agents from other clouds, an Entra Agent ID for each agent, support for agents acting on behalf of users and with their own access, and Defender and Purview integration. It is available in Microsoft 365 E7 or standalone at $15 per user per month. Strength: the most native option for a Microsoft-centered estate and the clearest agent identity model here.
- Where enforcement occurs: in Microsoft's cloud, through Entra and network controls. Nothing documented runs inside your boundary [U].
- Identity and permissions: Entra Agent ID with delegated and own-access agents [V], governed in your Microsoft tenant.
- Log retention: Purview audit logs of agent activity live in Microsoft's cloud [V], so they are not inside your boundary. Tamper resistance is [U].
- What you operate: licensing and tenant configuration.
- Confirm: spend limits cover Microsoft's usage-based agent services and not model spend for agents elsewhere [U], and we found no Agent 365-specific NIST AI RMF, EU AI Act, or AIUC-1 mapping.
Which One Fits
- Self-hosted runtime enforcement, MCP and tool controls, spend limits, and evidence inside your boundary: Prediction Guard or TrueFoundry. Choose Prediction Guard when agent authority and audit evidence are the center of the requirement, and TrueFoundry when you also want model serving and GPU orchestration in the same platform. Add IBM to the shortlist if you already run IBM software and can confirm the agent controls on-prem. If you need enforcement and evidence inside your boundary and can run that infrastructure, Prediction Guard fits, but it is not a substitute for an assessment-first workflow such as IBM watsonx.governance or Credo AI.
- An assessment and compliance workflow with framework packs: Credo AI or IBM watsonx.governance.
- Inspection of prompts, outputs, and tool calls that you can self-host: Lakera's Check Point AI Guardrails, or Guardrails AI as an open-source library you operate yourself.
- Observability and evaluation with inline inspection in a VPC or on-prem: Fiddler.
- Agents that live inside Microsoft 365, where SaaS hosting is acceptable: Microsoft Agent 365.
These are not mutually exclusive: many regulated teams pair an assessment platform with a control plane, and a inspection component can sit inside a control plane. The related reading under the comparison table covers the gateway versus control plane distinction.
What Financial Services Buyers Should Weigh
Ask every vendor the same four questions, then add the regulatory context.
- Where does enforcement occur? On the live request path inside your boundary, covering tool calls and not only prompts, or in a hosted service or an assessment workflow that sits beside it.
- Who controls identity and permissions? Your institution, through per-user delegated authority and scoped tool access, or a shared credential or an external directory you do not run.
- Where are logs retained? Inside your boundary, in a form an examiner can trust, or in the vendor's cloud.
- What must you operate yourself? Self-hosting moves infrastructure, upgrades, and incident response to you.
The regulatory ground shifted this year. On April 17, 2026, the Federal Reserve (SR 26-2), the OCC (Bulletin 2026-13), and the FDIC issued revised model risk guidance that replaced SR 11-7, and it states that generative and agentic AI are outside its scope. Banks are left to apply their own risk management practices to agents, so check whether a vendor's compliance mapping still cites SR 11-7. Ownership is part of third-party risk as well: two platforms here have changed hands since September 2025, with Lakera joining Check Point and Guardrails AI joining Harvey.
FAQs
1. Which of these platforms can run fully air-gapped?
Vendor documentation describes air-gapped deployment for Prediction Guard, Fiddler, TrueFoundry on its Enterprise plan, Lakera's self-hosted AI Guardrails with an Enterprise license, and Credo AI's self-hosted install. IBM watsonx.governance is reported to support air-gapped installs, which is worth confirming with IBM, and Guardrails AI is an open-source library you can host yourself, with no supported air-gapped offering confirmed. Microsoft Agent 365 is hosted by Microsoft, so it does not fit an air-gapped requirement.
2. Is an assessment platform the same as an agent control platform?
No. Assessment platforms such as Credo AI and IBM watsonx.governance inventory systems, run risk assessments, and map evidence to frameworks. An agent control platform enforces policy on live requests, such as which tool calls are permitted and how much an agent may spend. Many regulated teams use both.
3. Does SR 26-2 cover AI agents?
No. The revised model risk guidance issued on April 17, 2026 (SR 26-2 from the Federal Reserve, with matching OCC and FDIC issuances) replaced SR 11-7 and states that generative and agentic AI models are outside its scope. Banks are expected to apply their own risk management practices to those systems, and the agencies have said they plan to seek input on AI-specific model risk guidance. Until then, the runtime controls and evidence a platform produces become part of the bank's own demonstration of control.
4. Have any of these vendors been acquired recently?
Yes, two. Check Point announced its acquisition of Lakera in September 2025 and closed it on October 22, 2025, and Lakera's product now sells as Check Point AI Guardrails. Harvey announced on September 9, 2026 that it had acquired Guardrails AI. The open-source framework remains available, but the hosted Hub installer and remote inference were retired in August 2026. Ownership changes belong in third-party risk reviews, especially for long-lived control components.
5. Does a self-hosted open-source library count as an on-prem control platform?
Not by itself. A library can often run in any environment you control, but that is technical feasibility, not a supported offering, and it typically leaves identity, authorization, audit logging, and upgrades to your team. Ask the maintainer what support, security patching, and air-gap documentation exist before relying on it for regulated workloads.