Agents multiply faster than oversight
Every platform now ships agents. Without an inventory and clear ownership, organizations can't say which agents exist, what they can access or who answers for them.
AI Enablement · AI Trust & Governance
Put a trust layer under every AI agent you run
AI agents no longer just answer questions. They update records, trigger payments and talk to your customers. Mirketa designs, implements and operates the AI trust layer that keeps every agent within policy, across Agentforce and every other platform you use, with the audit evidence regulators and boards now expect.
- Vendor-neutral across governance platforms
- Salesforce Crest Consulting Partner
- EU AI Act · NIST AI RMF · ISO 42001 aligned
Why now
Agents act. Regulators are watching. Boards want proof.
Governance used to mean a responsible AI policy on the intranet. With agents taking real actions in real systems, it now has to be enforced at run time and proven with evidence.
Each platform governs only itself
Platform trust controls are strong inside their own walls. Your risk spans Salesforce, your ERP, your cloud AI services and the SaaS tools your teams adopt on their own.
Regulation has real dates
The EU AI Act is phasing in, and frameworks such as the NIST AI RMF and ISO/IEC 42001 are becoming the language of customer audits and procurement questionnaires.
EU AI Act: key dates after the Digital Omnibus
2 Aug 2025
Obligations for general-purpose AI models
In effect2 Aug 2026
Article 50 transparency obligations, such as telling people they are interacting with AI
In effect2 Dec 2027
Stand-alone high-risk systems in Annex III, including employment, credit scoring, education and essential services
Upcoming2 Aug 2028
High-risk AI embedded in regulated products under Annex I, such as medical devices
Upcoming
Dates reflect Regulation (EU) 2026/1744, in force since 27 July 2026. This page is general information, not legal advice.
Our framework
The six layers of an enterprise AI trust layer
We build trust in layers, so every control has a purpose, an owner and evidence behind it. Each layer maps to the EU AI Act, the NIST AI RMF and ISO/IEC 42001, so one set of controls serves several frameworks.
01
Inventory and ownership
You can't govern agents you can't see.
- Registry of every AI system, model and agent, including shadow AI
- A named business owner and purpose for each one
02
Policy and risk classification
Not every agent needs the same controls.
- Risk tiers by use case, data sensitivity and autonomy
- EU AI Act classification and framework control mapping
03
Identity and access for agents
Agents need identities and least privilege, just like people.
- Agent identity, scoped tool permissions and read/write separation
- Governed MCP gateways for every system agents can reach
04
Runtime guardrails
Policy has to be enforced on every request, not reviewed later.
- PII masking, prompt-injection defense and toxicity filtering
- Grounding checks so answers come from approved sources
05
Human oversight
Autonomy is earned, not assumed.
- Approval gates for high-consequence actions
- Escalation paths and trust calibration as agents prove reliable
06
Observability and evidence
If it isn't logged, it didn't happen, as far as an auditor is concerned.
- End-to-end audit trails of inputs, data accessed and actions taken
- Evaluations, drift monitoring and audit-ready compliance reports
The market, decoded
The AI trust and governance landscape, and where each piece fits
The AI governance market has matured quickly, and Gartner published its first Magic Quadrant for AI Governance Platforms in June 2026. No single product covers every layer. We help you use what you already own, add only what is missing, and make the pieces work together.
| Category | Examples in the market | What it does well | Trust layers covered |
|---|---|---|---|
| Platform-native trust controls | Salesforce Einstein Trust Layer, Agentforce Guardrails, MuleSoft Agent Fabric | Data masking, prompt defense, toxicity detection and audit logging for agents inside the platform, plus governed MCP connections and agent identity | 03, 04, 06 |
| AI governance platforms | IBM watsonx.governance, ServiceNow AI Control Tower, Credo AI, OneTrust AI Governance, Holistic AI | AI and agent inventory, risk assessment, approval workflows, regulatory templates and audit-ready documentation | 01, 02, 05, 06 |
| Cloud and model guardrails | Amazon Bedrock Guardrails, Azure AI Content Safety, Google Cloud Model Armor, NVIDIA NeMo Guardrails | Input and output filtering, sensitive-data detection and policy enforcement around model calls | 04 |
| Data and privacy governance | Microsoft Purview, Collibra, Securiti | Data classification, lineage and access policy for the data AI consumes | 02, 03 |
| Observability and evaluation | Fiddler AI, Arize, LangSmith | Tracing, quality evaluation, drift and performance monitoring for models and agents | 06 |
Product names are trademarks of their respective owners and are listed for reference only. Listing does not imply partnership or endorsement. Mirketa is vendor-neutral and does not resell governance software.
Our point of view: a harness is not a control plane
Platform trust layers, such as the Einstein Trust Layer for Agentforce, are excellent within their own ecosystem, and we configure them fully. But most enterprises run agents across several vendors. Someone has to own the policy, inventory, oversight and evidence that span all of them. That cross-platform layer is where Mirketa focuses.
Use what you own before you buy
Many organizations already license governance capabilities through Salesforce, ServiceNow, OneTrust or their cloud provider without using them. We start by activating those, then recommend a dedicated governance platform only when your risk profile and scale justify it.
How we help
From first assessment to governance that runs itself
AI Governance Assessment
We inventory your AI systems and agents, classify risk, and run a gap analysis against the EU AI Act, NIST AI RMF and ISO/IEC 42001. You get a prioritized remediation roadmap.
Trust Layer Architecture
We design your six-layer trust layer, map native controls to gaps, and run a vendor-neutral evaluation if a governance platform is needed.
Controls Implementation
We configure the Einstein Trust Layer and Agentforce guardrails, build governed MCP gateways and approval gates, and connect audit logs into one evidence trail.
Governance Operating Model
We set up your AI council, decision rights, intake process and policies, plus AI literacy training for the people who build, approve and work alongside agents.
Audit and Certification Readiness
We prepare documentation and evidence packs for customer audits, procurement questionnaires and ISO/IEC 42001 certification.
Managed AI Governance
We monitor agents, review incidents, recalibrate autonomy and onboard new use cases through your governance process every month.
Governance by design
We build agents the way we govern them
Trust isn't a separate project for us. It's built into every agent and integration we deliver, so governance is never bolted on after go-live.
The same approval gates, escalation agents and trust calibration we recommend are standard in our agent development and system connectivity work.
- No production experiments. Every agent is tested against your policies before it touches live systems.
- Escalation built in. Agents ask a human when confidence is low instead of guessing.
- Autonomy grows with evidence. We expand what an agent may do only as its track record supports it.
- Model-agnostic and client-owned. Your controls survive a change of LLM provider, and everything we build belongs to you.
Industry expertise
Governance shaped to your regulatory reality
Healthcare
Keep protected health information masked and logged, require clinician sign-off on care and authorization decisions, and document AI use for payers and auditors.
Financial services
Extend model risk management to agents, and prepare credit and underwriting use cases for their high-risk classification under the EU AI Act.
Nonprofit and education
Protect donor and student data, and govern AI used in admissions, assessment and student services, which the EU AI Act treats as high-risk areas.
Manufacturing and supply chain
Control what agents may change in ERP and supplier systems, and keep a full trail of automated purchasing and compliance decisions.
How to start
AI Governance Assessment
A fixed-scope engagement that shows exactly where you stand and what to fix first, before an auditor, a customer or an incident asks.
Book your assessment →What you get
- An inventory of your AI systems and agents, with owners and risk tiers
- A gap analysis against the EU AI Act, NIST AI RMF and ISO/IEC 42001
- A review of the native trust controls you already license
- A target trust layer architecture
- A prioritized 90-day remediation plan
FAQ
AI trust and governance questions, answered
An AI trust layer is the set of controls that sits between AI agents and your people, data and systems. It decides what each agent may see and do, filters inputs and outputs, routes high-risk actions to humans, and records every step as audit evidence.
The Einstein Trust Layer is a strong foundation for agents inside Salesforce, covering data masking, prompt defense, toxicity detection and audit logging. Most enterprises also run AI outside Salesforce, so they need consistent policy, inventory, oversight and evidence across every platform. We configure the native controls fully and connect them to an enterprise-wide trust layer.
General-purpose AI model obligations have applied since 2 August 2025 and most Article 50 transparency obligations since 2 August 2026. Under the Digital Omnibus, obligations for stand-alone high-risk systems listed in Annex III now apply from 2 December 2027, and for high-risk AI in regulated products under Annex I from 2 August 2028. Confirm how these apply to you with your legal counsel.
We map controls to the EU AI Act, the NIST AI Risk Management Framework and ISO/IEC 42001, plus sector requirements such as HIPAA for healthcare data, so one set of controls produces evidence for several frameworks.
No. We are vendor-neutral. We help you use the native controls you already own, choose a governance platform only if you need one, and implement it so it works with your agents and systems.
MCP gives agents a standard way to reach your systems, but the protocol alone does not decide which agent may call which tool. A governed MCP layer adds agent identity, scoped permissions, approval gates and audit logs, which is where connectivity and trust meet.
Scale AI with confidence, not crossed fingers
Talk to our AI architects about where your agents run today and what it will take to govern them. We respond within one business day.
Frameworks referenced
- EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
- NIST AI Risk Management Framework
- ISO/IEC 42001 AI management systems
Get Started
Talk to an AI Governance Expert
Tell us where your agents run today and what it will take to govern them, and an AI architect will follow up within one business day.
- A specialist follows up within one business day
- A no-obligation conversation about your specific goals
- Answers from someone who actually works in this space
- Your information stays confidential
Certified PartnerSOC 2 CertifiedHIPAA ReadyEnterprise Ready
Certified Partner
SOC 2 Certified
HIPAA Ready
Enterprise Ready