How It Works

Five layers of control for every AI at your company.

Buddhi AI is the access control plane for AI agents. Every request passes through identity verification, policy checks, scoped retrieval, redaction, and audit logging, before a single token is returned.

Live Access Control Demo
Click a scenario to see how Buddhi AI evaluates it
1

Identity

Contractor via Claude Code

2

Policy Check

Scope “engineering”: DENIED

3

Scoped Memory

0 memories, access blocked

4

Redaction

Skipped, no content returned

5

Audit Log

Event recorded with timestamp, identity, scope, and result

Reason: Contractor role does not have access to engineering scope

Step 1

Identity Layer

Every request is tied to a verified identity, not just a role, but a specific agent, acting on behalf of a specific person. Buddhi AI never makes decisions in a vacuum.

Request IdentityVERIFIED
agent:Claude Code
role:Contractor
on_behalf_of:Raj Mehta
session:sess_8f3c2a9b
Step 2

Policy Engine

RBAC policies define exactly which memory scopes each role can access. Policies are visual, editable, and auditable, with no hidden rules and no silent overrides.

Role Policy MatrixRBAC
Role
eng
fin
exec
pub
CEO
Manager
IC
Contractor
Step 3

Scoped Memory

Memories are tagged with scopes (engineering, finance, exec-comms, public-docs). When an agent queries Buddhi AI, only the memories matching their policy are returned.

Scoped Memory Retrieval3 RESULTS

API Authentication Flow

PR #142

engineering

Database Migration Strategy

Slack #eng

engineering

Component Naming Convention

Manual

public-docs
Step 4

Redaction

Even within allowed scopes, sensitive fields like PII, secrets, and credentials are automatically redacted before they reach the agent. Nothing leaks through.

PII & Secret Redaction2 MASKED
api_key:sk-live-••••••••REDACTED
db_password:p@$$w0rd123REDACTED
author:Sarah KimSAFE
source:PR #142SAFE
Step 5

Audit Trail

Every access attempt, allowed or denied, is logged with timestamp, role, agent, source, and result. Compliance teams get a complete, tamper-proof record.

Audit Log EntryLOGGED
timestamp:2026-07-12T08:15:00Z
role:Contractor
agent:Claude Code
on_behalf_of:Raj Mehta
query:Show me the API auth flow
scope:engineering
result:deny