Map
Inventory the client, identity, provider credential, policy, egress, budget, and evidence boundaries.
Control mapHormuz for enterprise
AI velocity.
Without policy drift.
Put one governed request path between employee AI clients and the provider accounts your organization already owns.
Control coverage
01
Who may use which client and model?
02
What may leave the organization?
03
Which budget and policy version applied?
04
What can the organization prove later?
One control plane
Make AI access an operating system, not a spreadsheet.
The enterprise problem is not finding another model. It is keeping identity, provider access, policy, spend, and evidence coherent as adoption spreads.
Hormuz makes the gateway path the enforcement surface and keeps the commercial and operational boundaries explicit.
Control domains
Five questions every governed request must answer.
01
Identity
Map existing OIDC and directory identity to the organization, team, person, client, and policy principal.
02
Policy
Stage immutable versions, activate atomically, enforce request-time pinning, and preserve rollback evidence.
03
Data
Inspect transient request material for configured egress controls while keeping routine telemetry content-free.
04
Economics
Enforce budgets before provider egress and separate observed, estimated, reconciled, and unattributed amounts.
05
Operations
Expose bounded readiness, deadlines, drain behavior, and deployment-owned TLS, custody, recovery, and HA gates.
90-day paid pilot
Prove one bounded workflow before widening the route.
No fleet-wide promise. No generic transformation program. Start with a named client path, named policy owners, and named evidence gates.
Prove
Run a non-production path against agreed compatibility, denial, privacy, and attribution checks.
Evidence packDecide
Assess operational gaps, customer-owned controls, and the next deployment gate without inflating the claim.
Go / no-go memoAlpha boundary
Enterprise design does not equal enterprise certification.
Hormuz exposes current engineering evidence and open release gates separately. Customer deployment, TLS, custody, recovery, HA, independent review, and environment-specific certification are not collapsed into a single “enterprise-ready” badge.
Review the security boundaryFounder-led
Start with the governance review.
Bring one real workflow. Leave with a control map and a clear pilot boundary.