How Altrum works

Understand the pieces of Altrum and how an AI system moves from registration to governed traffic.

Altrum follows each AI system through four steps: register it, assess it, protect it with guardrails, and govern its traffic. The first three work today. The fourth arrives with the AI Gateway.

The pieces

Piece	What it is
Organization	Your company in Altrum. Everything you create belongs to it, and nobody outside it can see it.
Members	The people in your organization. Each has one role: Owner, Admin or Member. See Members and roles.
AI system	Something your organization builds or buys that uses a model: a support assistant, a fraud scorer, a drafting tool. Each has an owner, an initial risk rating and the model providers it uses. See AI systems.
Assessment	A conversation with Altrum’s assistant about one AI system. Your answers fill in a questionnaire, and submitting it finds the risks that apply. See Assessments.
Risk	Something that can go wrong with the AI system, with references to the NIST AI RMF and ISO/IEC 42001. Some are found by the assessment, some you add, and some Altrum applies to every AI system.
Control	A measure that answers one or more risks: preventive, detective, mitigating or administrative. Some controls are enforced by a guardrail.
Guardrail	A check on what people send to the AI system, what the model answers, or both. When it finds something it logs it, blocks it or masks it. See Guardrails.
Draft and live version	You change guardrails in a draft. Applying the draft makes it the next numbered version, and the newest applied version is the live one.
AI Gateway	Coming soon. The address your applications and coding agents send model requests to, so Altrum can apply guardrails, budgets and access rules to each one. See AI Gateway.
Virtual key	Coming soon. The key an application or a person sends to the AI Gateway. It belongs to your organization, and can belong to an AI system or to one person.
Reports	Coming soon. Views of governance posture, guardrail activity and cost. See Reports.

From assessment to guardrails

An assessment ends in a scope: the risks that apply, the controls that answer them, and the guardrails those controls map to. Submitting the assessment switches those guardrails on in your draft, set to Log only and with nothing chosen yet. The assistant then suggests settings from your answers, which you can add to the draft.

You decide what goes live. Review the scope, set up every guardrail marked Needs your action, test the draft, and choose Complete Assessment. Your saved draft becomes the live version and the assessment closes.

You can also configure guardrails without an assessment, at any time.

From guardrails to traffic

A live version is what Altrum enforces. Today you can test it against a sample message in the product. With the AI Gateway, every request an application sends for the AI system is checked against its live version before it reaches the model, and the answer is checked before it reaches the caller. If a check cannot be made, the request is not sent. A key attached to an AI system is checked against that AI system’s guardrails; any other key is checked against your organization’s. See Guardrails at runtime.

Who does what

Owners and admins manage the organization, its members and its AI systems. The owner of an AI system can run its assessment and configure its guardrails whatever their role. Every member can read AI systems, assessments and guardrails. See Members and roles for the full table.