AI Governance Gateway

Intercepts AI agent actions before execution, enriches them with DataHub metadata over MCP, and returns deterministic approve, deny or human review verdicts with an EU AI Act ready audit trail.

Comment

Inspiration

This started with a job interview. I was preparing for Gravitee, an API management company, and noticed they had moved into AI agent governance. Until then I had only thought about models in terms of quality, latency and cost. Never about what happens when the agent decides to act. Then I read OpenAI's cybersecurity evaluation, where the model found a misconfigured Docker API and read the answer directly instead of solving the challenge. It was not misbehaving. It was optimising. That stayed with me. Agents now edit databases. Blocklists kept flagging safe actions because they had no idea what the data was. A data catalogue already knows: classification, ownership, certification, lineage. MCP makes that reachable at decision time rather than review time. What I finished is almost nothing like what I set out to build. I am proud of that.

What it does

It sits between an AI agent and your data, and checks every action before it happens. When an agent says "delete the customers table", the Gateway pauses it and looks that table up in DataHub. Does it hold personal data? Who owns it? What breaks if it disappears? Then it runs those facts through a set of rules and answers one of three things: approve, deny, or send it to a human. Right now it governs 27 real tables across two domains: an e-commerce warehouse and a banking dataset, each tagged with how sensitive it is. Every answer goes into a log with the reason behind it, plus which catalogue lookups the decision actually rested on. So it never just says no. It shows its working, and you can hand that to an auditor months later.

How I built it

n8n runs the pipeline, so you can watch every step happen on a canvas. A request comes in, gets parsed, gets looked up in DataHub, gets checked against the rules, and comes out the other end as a verdict. All the catalogue lookups go through DataHub's MCP server. It offers eight tools and I use three: search to find the table, get_entities to read its tags and owner, and get_lineage to work out what breaks downstream, which only runs on destructive actions. For the regulations, I search two ways at once. One search matches by meaning, the other by exact wording, because "Article 5(1)(c)" needs to be found literally and meaning-based search blurs it into nearby articles. The results get merged. Groq's Llama 3.3 reads the request and pulls out facts. It never decides anything. Plain code makes the call, every time, so the same request always gets the same answer. Postgres stores the log, FastAPI ties it together, and the whole thing runs in Docker. I also built a second copy with DataHub switched off, so I could test whether the catalogue actually mattered.

Challenges I ran into

For the first few days my policy search was broken. A wrong address in my config meant it was searching an empty database, so it found nothing and the AI just filled in the gaps itself. Nothing crashed. The answers looked fine. That is the scary kind of bug. Then a single word cost me my demo. One line was reading the first table's information for every request, so no matter what you asked, it came back denying the customer table. My whole "same action, different data, different answer" idea was quietly broken. I only caught it by putting all three test results side by side. Two days before the deadline I found out the hackathon wanted DataHub accessed through MCP, not the direct method I had built. I rewrote that layer in 48 hours. And MCP had two traps of its own. When you send it a bad request it replies with an error written as ordinary text, so a broken call looks exactly like a working one. And the lineage tool defaults to looking upstream, when what I needed was downstream. Get that backwards and you get confident, sensible-looking, completely inverted answers. In a governance tool, that is the worst thing that can happen.

Accomplishments that I am proud of

The agent does not hallucinate. and I created 2 knowledge bases. I built a version of the system with DataHub switched off, on purpose, so the comparison could prove me wrong. It did not. Same request, same risk score, opposite answers. Without catalogue context it blocked a harmless public table and quoted four GDPR articles that had nothing to do with it. I also kept the AI out of the final decision. It only reads and extracts facts. The rules decide. Slower to build, but you get the same answer every time, and that is the only kind you can audit. And I actually finished. That has been my weak spot before.

What I learnt

The worst bugs do not crash anything. An empty search, one stale line of code, a wrong address in a config file. All three gave me output that looked completely correct. That is exactly why the audit log matters more than the verdict itself. Also that a data catalogue is not just documentation. It already knows what your data is, who owns it, and what breaks if you delete it. MCP is what lets an agent ask before acting instead of after.

What's next for AI Governance Gateway

A proper review queue. Right now "send it to a human" is an answer, not a place. Flagged actions should land somewhere a person can see them, approve or reject, and have that signed off in the log. Writing back to DataHub. The Gateway only reads at the moment, which was deliberate for something whose job is to be trusted. But MCP offers tools to propose changes rather than make them, and that lines up neatly with my three verdicts. Approve and deny could write a tag, human review could raise a proposal that sits waiting for a person. Rules kept like code, with version history, so you can see what changed and when. A bigger rulebook, so hybrid search earns its keep. And making it easy to drop into other setups. Nobody rebuilds their agent to add governance. If it is not close to plug and play, it does not get used.

Built With

Share this project:

Updates