Control cost and policy.
Keep the record.
Mosaic runs inside your perimeter across three layers: API, agent-to-agent and MCP. Six things in every engagement. They run together because they have to. The architecture decision is also the audit decision is also the cost decision.
What's included
Permissions on source and destination.
Every transaction needs an explicit permission grant on both the source and the destination. This agent may use this data connection, for this call.
Chained policy checks.
Each transaction runs a chain of checks. Data checks (a SQL call may only touch these fields), cost checks, and prompt checks (this agent may send this prompt to this model). Model routing and prompt capture run on LiteLLM, visible in the Mosaic UI.
Budgets that stop calls.
Cost accounting happens in the same step as the policy checks. Set budgets per application or per transaction type. When a budget is hit, calls stop. A dev team capped at 2 million tokens stays capped.
The audit trail.
Every grant, every policy check, and the reason each call was approved or denied is written to a log record. Traces and dashboards run on Langfuse, backed by ClickHouse. Query it and build your own compliance reports.
Your obligations, mapped to the controls.
We map the policy engine to your regulatory controls with your risk team. Without that mapping, standards are just words on paper. Mosaic produces the evidence. Your risk team signs off.
Deployment and handover.
Deployment, not development. We set Mosaic up in your environment, tune it, test it, then hand it over with runbooks and assurance. It runs in your network, so it is your system.
What's not included
Mosaic is software you run.
It is software we license, and it runs on-premise or in your own cloud account. Prompts, outputs and logs stay inside your boundary.
We don't replace what you run.
Vendor-neutral and additive. Mosaic works with AWS, Azure, Google Cloud and local models. Keep the model providers, agents and data sources you already trust.
We don't claim compliance for you.
Mosaic provides controls and evidence. Your risk team signs off, and our advisory work maps that evidence to your controls.
We don't bolt governance on later.
Permissions, budgets and audit are part of the deployment from kick-off. If a brief asks us to switch it on fast and add the governance later, we'll say no.
Agentic channels.
When you are ready, the same layer gives outside agents a governed front door. Your customers' procurement agents, and assistants like Claude, ChatGPT and Copilot, can discover and transact with you. Registered, rate-limited and logged, on your terms.
One layer. One team. One set of decisions, settled once.
Start a 30-minute conversation →