The project
The AI firewall
Cernis is an active, identity-aware filter between people and any AI system: it applies the company IAM permissions to every prompt, blocks with a stated reason whatever is outside the role, masks and anonymises personal data and logs every interaction on the SIEM.
It installs on-premise, air-gapped environments included: no data, prompt or log leaves the perimeter. It is independent of the AI provider, with models behind OpenAI-compatible APIs in the cloud or self-hosted, SSO sign-in, role-based profiles and SPID federation for public bodies.
The three pillars
- Identity-aware
- Semantic guardrail
- Logged on the SIEM
Product by
ITDM Group
Sector
AI governance
Deployment
On-premise, air-gapped
Identity
Company IAM and SPID
Compliance
AI Act, NIS2
Features
What it does
- Federation with company IAMs
- AD, LDAP, Keycloak, Entra, Okta
- SPID for public bodies
- Sign-in with company SSO
- Prompt intent and role
- Reasoned blocks outside the role
- Personal data masked
- Countering shadow AI
- OpenAI-compatible APIs
- Cloud or self-hosted
- Models and rules per role
- RAG on the knowledge base
- Every session on the SIEM
- Full audit trail
- Limits and budget per role
- AI Act, NIS2, Law 132/2025
Architecture
How it works
- IdentityEvery request arrives with the role and attributes already resolved by the IAM: AD, LDAP, Keycloak, Entra, AWS IAM, Okta, SPID.
- Semantic guardrailA small local LLM classifies the intent of the prompt and compares it with the perimeter of the role.
- DecisionOutside the role the request is blocked with a reason; within the role it goes through with personal data masked, to the right model.
- SIEMPrompt, decision and response reach Wazuh, Splunk, Elastic or Sentinel in real time.
Integrations