Skip to main content
Pick the path closest to your job and read in order. The role named with each path is the one that usually fits; your role decides what you can change, never what you can read here. See Members and roles.

​
Governance, risk and compliance

You keep the register of AI systems, run assessments and decide which controls apply. Usually a Governance Lead.
  1. How Altrum works, then Home.
  2. Discover the AI already in use, and register it as AI systems with a risk rating.
  3. Decide which models and MCP servers your organization may use.
  4. Run assessments and read their results.
  5. Turn the results into live controls with guardrail suggestions and Configure guardrails.
  6. Approve AI systems before they go live: Lifecycle.
  7. Follow Reporting, Alerts and Incidents.
  8. Hand an auditor a compliance report.

​
Security

You decide what an AI system may receive and say, and you need proof that it is enforced. Usually a Governance Lead, or an Admin if you also run the AI Gateway.
  1. Guardrails and Guardrail types.
  2. Test guardrails, Versions and Red-team runs.
  3. Guardrails at runtime: how every request is checked, and why a failed check stops it.
  4. Organization guardrails for traffic that belongs to no AI system.
  5. Request logs and Security and data: what Altrum keeps, and where.

​
AI builders

You build applications and use coding agents, and you want them governed without rewriting them. Usually a Member who owns the AI systems they build.
  1. AI Gateway overview, then Send your first request.
  2. SDKs and Coding agents.
  3. MCP tools and Prompts.
  4. Handle errors, so your application knows what to do when a guardrail or a budget stops a request.
  5. The API reference for every endpoint and header.

​
Administrators

You run your organization in Altrum: people, access and the AI Gateway’s settings. Usually an Admin or an Owner.
  1. Sign in, Members and roles and Plans and modules.
  2. Provider credentials and Virtual keys.
  3. Budgets and rate limits, content logging, the semantic cache and OpenTelemetry.
  4. Alerts: which rules run and who hears about them.
  5. Access reviews each quarter.

​
Auditors

You check that the controls exist and work, and you change nothing. Usually an Auditor. The role lasts until an owner or admin removes it or gives you another one.
  1. Home and Posture.
  2. Compliance reports for one AI system or the whole organization.
  3. The Audit trail: who changed what, and when.
  4. Access reviews, the Model catalog and MCP servers: what was kept, approved or blocked, by whom and why.
  5. AI systems and Incidents: ratings, approvals, history, and how problems were handled.