Governed Agentic AI · Reference Architecture
Governance was always
an enforcement problem.
AI just removed the friction that hid it.
A multi-agent financial crime investigation system built on Neo4j, Anthropic Claude, and a dual gateway control plane — demonstrating that a gateway control plane is the only way to make AI governance real at execution.
Most AI governance frameworks describe what should happen. This system enforces what can happen. Entity Risk AI is a fully governed multi-agent investigation platform. Every tool call and every LLM invocation routes through a dual gateway control plane before reaching any upstream service. Denied actions are blocked, logged, and traceable. No agent — and no human — bypasses the control plane. The audit trail lives in Neo4j as a queryable subgraph, not a flat log file.
Governance Lives Outside the System
Organisations have policies, roles, and approval workflows. What most don't have is a single point where those policies are enforced at the moment a decision is made. Governance describes intent. Execution determines reality.
AI agents make this gap impossible to ignore. They don't hesitate. They don't ask for exceptions. They execute every permitted path, consistently, at machine speed. What was occasional becomes guaranteed.
The Fix Is Architectural, Not Cultural
The answer is not more policy documentation. It is a control plane — a single enforcement layer that sits between intent and execution for every action, human or agent, before it happens.
That layer must be centralised (no bypass paths), fail-closed (denied actions blocked and logged), fully traceable, and role-consistent — the same gate applies to humans and agents equally.
Routes all 15 investigation tools through Kong's /mcp route with key-auth validation. Consumer groups enforce per-role restrictions. Denials return HTTP 403 and are traced.
All Anthropic calls route through Kong's AI Gateway. The planner uses /ai/sonnet; agents use /ai. The app never holds the Anthropic API key.
- 1Agents don't introduce new risk. They make existing system permissiveness executable at scale. This addresses the root cause — the absence of an enforcement layer.
- 2The gateway becomes the control plane for agentic AI. The single enforcement point between intent and execution — for both tool calls and model invocations.
- 3The audit trail is proof, not documentation. Every action captured at execution time in a queryable graph. Retroactively demonstrable and reliable.
- 4The same rules apply to everyone. Humans and agents governed identically. Same gate. Same policy. Every time. No carve-outs.
- 5Production-deployable, not a proof of concept. Open-sourced Apache 2.0, hosted on Railway + Neo4j AuraDB, built on public Companies House UBO data.
The Problem · Entity Risk AI
AI agents expose governance gaps.
They don't create them.
Organisations have policies, roles, and approval workflows. What most don't have is a single point where those policies are enforced at the moment a decision is made — before an action reaches any system.
Enterprises operating in regulated industries — financial services, government, telco — have invested heavily in governance frameworks: role-based access, approval workflows, audit logging. But these controls live in documents, not in systems. When AI agents arrive, they execute every permitted path, consistently, at machine speed. What was occasional human error becomes guaranteed systemic behaviour.
The requirement
Design a multi-agent financial crime investigation system where every tool call and every LLM invocation is evaluated against policy before it reaches any upstream service. Governance must be enforced at execution — not described in a README. Denied actions must be blocked, logged, and traceable. No bypass paths.
The constraint
The same rules must apply to human analysts and AI agents equally. A junior analyst restricted from a sensitive tool must face the same gate whether they click a button or an agent acts on their behalf. Role-based access cannot live in application code — it must be centralised and fail-closed.
Entity Risk AI demonstrates that a gateway control plane is the only architectural pattern that makes AI governance real. Policies are not described — they are enforced at the moment of execution, for humans and agents equally, with a queryable audit trail that proves enforcement occurred.
- 1Same rules, every actor. Junior and senior analysts have structurally different tool access enforced at the gateway via consumer groups — not in application code. The gate applies to agents acting on their behalf identically.
- 2No upstream credentials in the application. The app holds only a consumer key. The gateway injects the Anthropic API key and the upstream MCP credentials. Compromise of the application does not expose upstream systems.
- 3The audit trail is proof, not documentation. TraceEvent nodes are written at execution time — retroactively demonstrable, not reconstructed from logs.
- 4Production-deployable, not a proof of concept. Open-sourced Apache 2.0, hosted on Railway and Neo4j AuraDB, built on public Companies House UBO data.
What Enforcement Actually Requires
A single control plane, enforced across multiple execution points. Every action, human or agent, evaluated before it reaches any system. · Click any component to explore it.
to explore it
Solution Architecture
↗ Click any component to explore its role
to explore it
System Control Flow
↗ Click any participant or message row to see what happens at that step
or message row
to explore it
Graph Data Model
↗ Click any node or relationship to explore its full schema · Business graph (left) and Trace subgraph (right) shown together
or relationship
to explore its schema
Control Plane Configuration
Click any route or tool to inspect its full configuration
ai-gateway-serviceentity-risk-ai-app (X-API-Key auth)mcp-upstream-serviceentity-risk-ai-production.up.railway.app