Neural Inverse Govern / Context for agents
Agents work from approved knowledge, checked for the person asking on every retrieval.
Spaces of code, issues and team knowledge that follow your organisation, served to the Editor, the Agents app, the CLI and MCP clients with authorisation, DLP and a token budget, and recorded as evidence.
- Sources
- GitHub code and issues, personal documents
- Classification
- Four levels, tighten only
- Served to
- Editor, Agents app, CLI and MCP clients
- Evidence
- HMAC-chained attribution
- Runs
- Inside Govern, on PostgreSQL
Overview
The Context Platform decides what context an AI tool may see. It indexes repositories, issues and team knowledge into spaces that follow your organisation's structure, and answers every retrieval through the same fixed steps: authorise each space for the person asking, search, rank, apply DLP by classification, cut to a token budget, and record exactly which chunks were delivered.
What it does
What the Context Platform does.
Governed retrieval for every AI tool, and the shared knowledge teams build around it.
Spaces that follow your organisationOne space for every organisation, department, team, group and project, kept in step with your directory. A deleted node's space is archived, never deleted.
GitHub through your own AppRepositories and issues are read through a GitHub App your organisation owns, with read-only permissions and tokens limited to one repository. Personal access tokens are not accepted.
IndexingVersioned, re-run on push and caught up by a maintenance scan. Environment, secret, key and credential files are skipped by path before any content is read, so they are never stored.
Authorisation on every retrievalEach space is checked for the person asking before anything is searched: organisation deny rules, the role grant and membership by classification. Restricted spaces are readable by their own members only, with no administrator override.
Classification and DLPFour levels, inherited from the strictest ancestor and only ever raised. Findings are redacted at public and internal, dropped at confidential, and withhold the whole source at restricted; regulated projects get at least drop.
Embeddings behind DLPVector search is optional. Confidential and restricted sources are never sent to an external embeddings endpoint, and every other chunk is redacted before it is embedded.
AttributionEvery retrieval is recorded with the person, the spaces, the sources and a SHA-256 of every chunk delivered, in an HMAC-chained evidence record verified daily.
Linked to the model callWhen the Neural Inverse apps call a model through the AI Gateway, they name the retrieval they used, and the link is appended to the same evidence chain.
LensesSaved selections of sources that people share at view, use or edit level, with expiry and approval above a classification line. Sharing a lens never grants access to content.
Snapshots and handoffsImmutable snapshots of retrieved context, handed to the reviewers of a pull request and shown through each reviewer's own authorisation.
Pair sessionsInvite-only live sessions that retrieve through one shared lens, with a recording of the retrievals made in them.
Team memoryDecisions, conventions, notes and glossary entries a team edits together. Only text another member reviewed and accepted reaches the AI.
Work registryWho is changing what in each repository, and where two pieces of work overlap. Advisory only, and it holds names, never code or content.
Agent instruction filesCLAUDE.md, AGENTS.md and similar files kept in organisation, team, project and personal layers, with versions, approval, rollback and legal hold, and a record of which versions each agent session started with.
Collaboration policySwitches and limits for sharing, handoffs, pair sessions, team memory and agent files per organisation, department, team and project, with a classification ceiling and share expiry. Lower levels only tighten.
MCP endpoint and live feedMCP clients retrieve through the same steps as the person signed in. The Neural Inverse apps follow changes through an ordered event feed that carries ids, never content.
Source connectors exist for GitHub repositories, issues and pull requests, and personal documents; wikis, documentation systems and conversations are not available yet. The collaboration policy, team memory, the work registry and agent instruction files have no console page yet; they are used from the Neural Inverse apps and the API.
How it works
How a retrieval is answered.
Every retrieval takes the same steps, whether it comes from an app, an MCP client, a lens or the endpoint agent. A failure at any step fails the request closed.
- CandidatesThe spaces that can contribute: the project's chain and the caller's own teams and groups.
- AuthoriseEach space is checked for the caller. Spaces that fail are dropped before anything is searched.
- SearchFull-text, and vector search where configured, over the authorised spaces only.
- RankA hybrid score, weighted by the level of the space the chunk came from.
- ProtectThe DLP action of each source's classification is applied to every chunk.
- BudgetChunks are added in rank order until the token budget is used.
- AttributeThe request, spaces, sources and a hash of every chunk go to the evidence chain.
Who uses it
Built for every role that answers for AI.
Platform administratorsConnect the GitHub App, add sources, set classifications and organisation deny rules.
Security and compliance teamsSet collaboration policy and ceilings, oversee and revoke shares, and read attribution records.
EngineersGet governed context in the Editor, the Agents app and the CLI; share lenses and hand context to reviewers.
Team leadsAccept team memory entries and see where their team's work overlaps with another's.
Enforced and recorded
What is checked on every request, and what is advisory.
Access to context is enforced by the server for each person. Some features only inform; they say so.
Enforced
Per-space authorisationOn retrieval, lenses, snapshots, handoffs, pair sessions and the MCP endpoint. A database error fails closed, and an object the caller may not read answers like one that never existed.
Deny rulesOrganisation deny rules refuse Context actions on chosen nodes for everyone, super admins included.
ClassificationDLP by level, tighten-only values, and frozen content re-scanned at the stricter of its captured and current level.
Decisions by peopleApproving an agent file version, setting a legal hold, accepting team memory, sharing a lens and acknowledging an overlap refuse API keys. Nobody approves their own.
Secret filesA built-in deny list of environment, key and credential files applies to indexing, agent files and shares. No policy can remove it.
Recorded
RetrievalsEvery retrieval and every model call linked to it, with the verified OAuth client. The app name an app declares is recorded, never trusted.
Agent sessionsThe exact set of instruction files an agent session started with.
Policy and sharesEvery collaboration policy version, immutable, with author and reason; every share revocation with its reason.
Work registryAdvisory only: it never blocks work. The first acknowledgement of an overlap by a person is an audit entry.
PostgreSQL onlySpaces, sources, chunks and the event feed are held in PostgreSQL. No message broker is needed.
Embeddings optionalFull-text search works on its own. An embeddings endpoint inside your deployment adds vector search.
GitHub EnterpriseYour own GitHub host can be added to the hosts the connector accepts.
Hosted by usWe run it for you, with the same controls and audit record.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.