How it works
A gate on every machine, policy from one place.
Piquant has three parts. An agent on each machine checks every call. An optional gateway serves shared company tools. A control plane on your own server holds policy, relays approvals and keeps the record.
The parts
Where Piquant runs
Agent, on each machine
Runs once per Windows or Linux machine as a system service. It knows who is calling from their sign-in to the operating system, applies their policy and adds their keys.
Piquant app
Shows each person their status, what they can use, requests waiting for them and the AI tools on their machine. It asks approvers to decide.
Gateway, optional
Serves shared company tools from one server, with company keys that never reach a laptop. claude.ai, ChatGPT, Copilot Studio and automated agents connect here.
Control plane
On your own Linux or Windows server: signed policy, approvals across machines, the record of every decision, an admin console and the kill switch.
AI-tool modes
Three modes, set per person by policy
The mode decides how far Piquant reaches into a person's AI tools. It follows their Entra role.
| Mode | For | What happens |
|---|---|---|
| Free | People evaluating AI tools | Piquant shows what their AI tools use but changes nothing. Calls through Piquant still follow policy. |
| Provide | Most people | Piquant adds the approved company connections to their AI tools. Their own connections keep working, with a warning. |
| Lock | People who work with sensitive systems | Their AI tools may use only connections that go through Piquant. Every call follows policy and is recorded. |
Policy
Rules written once, signed, and followed everywhere
A rule names who it covers (an Entra role, a group or a person), which tools on which servers, and the effect: allow, deny, or allow after an approval.
Policy is prepared in the console, reviewed, and signed on an administrator's workstation, never on a server. Every agent checks the signature before it follows a rule, so neither a compromised server nor anyone between them can change what people may do.
Anything no rule allows is denied.
A rule, in words
Standard users may read issues and code on GitHub. Merging needs a team lead's approval. Deleting a repository is denied for everyone.
When something goes wrong
Stop it within seconds, and know what happened
Kill switch
Suspend a person, a tool or a device from the console, the command line or a security playbook. Calls stop within seconds; the person's Piquant app says why and until when.
A record of every decision
Who called which tool, the decision and the rule behind it, in a chain where a removed or changed entry shows. Never the content of the call.
To your SIEM
Records go to your own control plane, and from there through OpenTelemetry to the tools your security team already uses.
Tamper checks
Agents report the state of their installation. A configuration changed by hand on a machine is flagged in the console.
Start with one team.
A pilot begins in provide mode: people keep their AI tools, and Piquant adds the governed connections. Locking, approvals and shared company tools follow when the team is ready.