Startups

Speed is the whole advantage of a young company, and governance usually arrives after the first incident. The incident is normally small. It is a key left in a prompt, or a demo endpoint found by a script. This starter is the minimum worth having on day one, and it is meant to be outgrown.

This is the smallest starter in the family. Six controls run in the chain. Four of them address those two failures directly, and nothing else is added for show.

Secret detection masks interface keys, passwords, bearer tokens and private key blocks, and it masks rather than refuses so iteration continues. Personal data masking covers street addresses only, which is honest about how narrow the pattern set is. Automated traffic detection refuses a client above 20 requests each minute, and the deployment ceiling is 300 requests each minute.

History capture runs in raw mode, and that is the setting to think about first. Full prompt and response content is captured while the team learns how AI gets used. Move to a redacted or metadata mode before customer data enters those prompts.

Scoring stops only the weakest output, at a combined 0.70 with relevance at 0.68, which is a low bar by design. There is no identity requirement, no term based safety rule and no review step in this configuration. Read the result as a first control record that an auditor can build on. Add access control and a review gate before this starter carries regulated work.