Frequently asked questions

Praesidia is the control plane for AI agents. It authenticates, governs, and monitors the interactions between your applications, AI agents, and MCP servers that pass through it, from a single platform. Instead of stitching together a gateway, a guardrails service, a cost tracker, an observability tool, and a compliance platform, you get all six control domains — identity, guardrails, cost, governance, observability, and orchestration — in one place.

Any team running AI agents in production — from startups shipping their first agent to enterprises governing a fleet across departments. If you have applications, agents, or MCP servers talking to each other or to external services, and you need to control who can call what, what they can say, what it costs, and prove it to an auditor, Praesidia is built for you.

Most teams run AI on a patchwork of separate tools — one vendor for the gateway, another for observability, another for guardrails, another for cost tracking, another for compliance — and then maintain the glue between them. Every seam is a potential security gap, a surprise bill, and an audit headache. Praesidia replaces that sprawl with one control plane: one platform, one audit trail, one bill.

Traditional IAM thinks in terms of identities and permissions on individual resources. Praesidia thinks in terms of relationships between AI entities, with content-aware guardrails. Controls attach to the organization (org-wide guardrails), to an agent (its own guardrails and policy) and to the connection between two agents (its policy) — so you control not just who can talk to whom, but what a connection may carry and what guardrails let through on the way in and on the way out.

Three entity types, all first-class citizens: Applications (web and mobile apps), MCP Servers (Model Context Protocol servers), and Agents (external agents, or agents you build and deploy through the platform). Each one gets its own credentials, configurable guardrails, and operational policies.

Identity & Access (credentials for every agent, plus SSO, SCIM, MFA, and role-based access for your team); Guardrails & Content Safety (check content going into and coming out of an agent, and block or redact what breaks a rule); Governance & Compliance (append-only audit trails, records signed under the default configuration, and the controls behind major frameworks); Cost & FinOps (attribute spend and set hard caps); Observability & Audit (logs, metrics, and traces, exportable to your SIEM on the Advanced tier and Enterprise); and Connect, Build & Orchestrate (govern connections, chain workflows, and deploy agents). They are designed to work together on one platform.

A connection defines a trusted relationship between two entities. It specifies which entities can communicate and the policy that governs that communication. Connections can be simple point-to-point or orchestrated into multi-layered, multi-step setups.

Guardrails are content-level controls that inspect what is said or requested in messages between entities — they can block, redact, or warn on things like prompt injection, sensitive data (PII), and policy violations, and each one checks what goes in, what comes out, or both. Policies are operational controls set on a connection: rate limits, time-based access, a monthly spend cap, approval before a task runs, and which task types, models and tools the connection may carry. IP allowlists sit beside them, set for the organization or a service-account key rather than per connection.

It applies to guardrails. Each guardrail is set to check what goes in, what comes out, or both: what goes in is a task's input, checked before the task is dispatched to the receiving agent, and what comes out is the agent's result, checked before it is returned. A guardrail can block or redact either, so you can stop a bad request before it reaches the agent and an unsafe response before it comes back. A connection's policy has no direction: there is one policy per connection, enforced when a task is dispatched over it.

Each entity registers with Praesidia and receives its own credentials (a client key and secret). Every request between connected entities is authenticated through Praesidia, so only authorized entities can communicate. Your team members authenticate separately through standard options like SSO, MFA, and passkeys.

Yes. You can connect external agents you already run, or define and deploy OpenClaw and ZeroClaw agents directly from the platform — no local development and no manual deployment. Configure the agent, pick a cloud provider for the agents you deploy through Praesidia (such as Heroku, Render, Hetzner, or Scalingo), and ship it; deploy targets are included on the Team plan and above. That choice is about where your agents run, not where Praesidia itself runs — see hosting and data location for that. Every agent gets full lifecycle management from creation to monitoring.

Yes. Go beyond single connections and chain apps, agents, and MCP servers into multi-step pipelines on a visual canvas, with security enforced at every hop. You can build workflows by hand or describe what you want and generate a starting workflow, then run, schedule, and monitor them with the same guardrails, policies, and audit trail applied throughout.

Yes — Model Context Protocol servers are a first-class entity type. Praesidia provides the authentication and authorization layer your MCP servers need, applies policies to their tool calls, and records the decisions it makes on those calls in the audit trail. Guardrails check the arguments and the result of a tool call an agent makes during a chat turn. You can govern the MCP servers you host and the ones your agents connect out to.

If you choose to publish them. You can register public agents and MCP servers that others can find and connect to, building an ecosystem of reusable AI services within your organization or across the community. Discovery is opt-in — entities stay private unless you publish them.

Yes. Praesidia is bring-your-own-key and model-agnostic, and your provider keys stay under your control. Through the gateway's one base URL or as an agent's configured model, from the same list on both paths: OpenAI, Anthropic, Azure OpenAI, Google Gemini, Mistral AI, Cohere, DeepSeek, Qwen, Moonshot, a self-hosted Ollama, or your own OpenAI-compatible endpoint. You are not locked into a single model or vendor.

Praesidia attributes spend to every agent, team, connection, and workflow, so you can see exactly where your AI budget is going instead of getting a single opaque provider bill. On top of that visibility you can set budgets and hard spend caps that stop runaway costs before they reach your invoice.

Yes. You can define budget policies with hard spend caps that act as an enforcement control, not just an after-the-fact alert. Budgets can be scoped so a runaway agent or workflow is stopped at the cap rather than discovered on next month's bill.

Yes. Usage and cost are tracked per connection and rolled up so you can break spend down by agent, team, and workflow. That makes it straightforward to charge back internally, spot the most expensive flows, and forecast cost as you scale.

Each organization's data is isolated from other organizations'. Every entity, connection, policy, and log belongs to your organization, and access is scoped to your organization on every request. Members only see and act on data within the organizations they belong to, governed by role-based access control.

For the people who manage your AI estate, Praesidia supports SSO (SAML and OIDC), SCIM provisioning, multi-factor authentication (TOTP and backup codes), and passkeys. Access is governed by role-based access control with organizations and teams, so you can give the right people the right level of access and provision or deprovision them automatically.

Praesidia is built to give you the controls and evidence behind the standards your compliance team asks about — SOC 2, GDPR, the EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework, and the OWASP Top 10 for LLMs — so you are ready when auditors ask.

Requests, responses and policy decisions that reach Praesidia are logged, so you can see that activity in real time. Calls that do not pass through Praesidia are not recorded. Audit trails are append-only, and records are signed and hash-chained under the default configuration, which an operator can turn off, so the trail is independently verifiable: an edit to a signed record, or removal from the middle of the chain, is detectable; removal of the most recent records is detectable only with external anchoring turned on. A signed record shows it was not changed afterwards. It does not show that every action was captured. On the Advanced tier and Enterprise you can forward security events to Splunk, Datadog or Microsoft Sentinel, and on every plan you can scrape your organization's metrics in Prometheus format into the monitoring you already run.

Praesidia is built by an EU company (Squad Technology SRL, Cluj-Napoca, Romania) and operates under GDPR. Production runs on Render behind Cloudflare, whose global edge terminates TLS; where Render runs it is not stated here. The full provider inventory and data-location statement are in the Trust Center.

There is a free Developer plan at $0/month with no credit card required — enough to register your first agents, define connections, and see the audit trail in action. Beyond Developer, a founder-led Design Partner pilot and Enterprise are scoped with you — self-serve payment is not open yet. See the pricing page.

Praesidia is proprietary, commercially licensed software. The audit verifier and the client SDKs carry permissive open-source licences (Apache-2.0 and MIT) and are distributed directly to customers and their auditors; the source repositories are not public today. How the verifier is used is described on verify your audit trail.

Enterprise capabilities build on the same control plane — SSO and SCIM for your identity provider, custom roles and granular permissions, advanced analytics, and the governance and audit features your security and compliance teams need to operate AI at scale. Get in touch through the platform to discuss enterprise access.

Sign up at app.praesidia.ai, register your first entity (an app, MCP server, or agent), and create a connection. You can have authenticated, governed AI interactions running in minutes. The documentation has step-by-step guides for each entity type.

Minutes, not months. The flow is three steps: register your entities, define which ones can talk to each other, and apply guardrails and policies to those connections. You can start with a single connection and add controls, workflows, and more entities as you grow.

Praesidia exposes an OpenAPI-described REST API with built-in credential management. Agent frameworks connect through the runtime integrations documented for LangGraph and the OpenAI Agents SDK, among others, with the CrewAI release in validation; the full list of supported protocols, model providers, and tools is on the integrations page.

No. You can start with one connection or one entity and expand from there. Because security events forward to your SIEM on the Advanced tier and Enterprise and your organization's metrics can be scraped by the monitoring you already run, Praesidia fits alongside your existing stack while you consolidate onto a single control plane at your own pace.