Security & Governance

Security & Governance for Agentic Operations

Enterprise security teams ask hard questions before approving infrastructure automation. The Itential Platform is built to answer them. SOC 2 Type II certified, RBAC enforced on every action including AI, zero infrastructure data copies, and execution that stays in your environment.

Request a Demo Explore the Trust Center

Security & Governance Built In

Every Action Governed. Every Change Auditable. Every Agent Controlled.

Itential is architected so security and governance are not bolt-ons. SOC 2 Type II by default. RBAC and audit trails enforced on every human and AI action. No data copies, no exposure, execution stays in your environment. The same governance applies whether a person, a workflow, or a FlowAgent triggered the change.

Architecting Hybrid AI for Infrastructure Operations

Zero Data Retention

No copies. No exposure. Your systems of record stay the source of truth. Execution stays in your environment via the Itential Gateway.

Governance Across Every Actor

RBAC, approval gates, and audit trails enforced equally on humans, workflows, and FlowAgents. Same governance, regardless of who or what triggered the change.

SOC 2 Type II by Default

Annually audited by an independent third party. GDPR and CCPA aligned. Encryption in transit and at rest. Continuous vulnerability scanning and annual penetration testing.

AI Governance Built In

Scoped tools at design time. Two-layer agent RBAC. Every AI action logged with full attribution. FlowAgents never touch infrastructure directly.

Security

Secure by Design, Verified by Audit

Itential is built so your data never leaves your control. No copies, no exposure. Your systems of record stay the source of truth, execution stays in your environment, and every action, human or AI-initiated, flows through governed workflows with full audit trails.

Itential Trust Center Request SOC 2 Report

Zero Data Retention

Itential never creates copies of your data. Your existing systems of record remain the source of truth at all times. Execution stays in your environment via the Itential Gateway.

Enterprise Access Control

RBAC policies apply equally to human operators and AI agents, with granular permissions, approval gates, and full audit trails on every infrastructure action. AI never touches infrastructure directly.

Certified & Compliant

SOC 2 Type II certified. GDPR and CCPA compliant. Encryption in transit and at rest. Third-party penetration tested annually, with results available through the Trust Center on request.

AI Governance

How the Itential Platform Governs AI Actions

AI agents on Itential, whether FlowAgents built on the platform or external AI systems connected via MCP, run through the same governed execution layer as every human action. Agents act through scoped tools registered at design time, RBAC applies to who can build and who can run, and every AI request is logged with full attribution. AI never touches infrastructure directly.

Itential Trust Center Explore FlowAI

Scoped Tools, Locked at Design Time

Each FlowAgent gets an explicit allowlist of platform capabilities selected from the Tool Registry. That list is locked at design time and validated at runtime, agents call only the tools they have been granted, anything outside that scope is rejected before it dispatches.

Two-Layer Agent RBAC

Project-level access controls who can view, modify, or delete the agent definition. Agent-level access controls who can run it. Same group-based model already governing every other platform asset, applied to FlowAgents and external MCP tools alike.

Every AI Request Logged

Every AI-initiated action logged with full attribution: which agent made the request, what tools were called, what inputs and outputs flowed through, and what the outcome was. Execution traces stored as a durable, ordered event log, ready for audit.

Platform Security Architecture

The Controls Behind Every Itential Deployment

Itential’s cloud-native SaaS platform runs on hardened AWS infrastructure with controls built in across data handling, identity, infrastructure, and secrets management. Every layer of the platform is designed for the security review that comes before enterprise adoption, with documentation available through the Trust Center.

Itential Trust Center

Data & Encryption

All data in transit encrypted with TLS 1.2 and SHA-256 certificates. Data at rest encrypted with industry-standard algorithms and customer-controlled key options available. The platform does not process PII.

Identity & Access

SAML and OpenID Connect SSO, MFA enforcement, and SCIM directory sync supported. RBAC and GBAC enforced throughout the platform for human operators and AI agents. Least-privilege access model applied to all Itential personnel and systems.

Infrastructure & Secrets

Hosted on AWS US East 2 in a multi-AZ redundant architecture. Hardened AMIs, restricted VPCs, daily backups with point-in-time restore tested annually. Credentials remain in customer-controlled vaults, never stored in workflows, injected at runtime only.

Security by the Numbers

The Proof Behind the Promise

Itential Trust Center Request a SOC 2 Report

SOC 2

Type II Certified

Audited annually by independent third party.

24/7

Vulnerability Response

Monitored security incident response at vulnerabilities@itential.com.

Zero

Customer Data Used to Train AI

Your configs, telemetry, and operational data never leave your control.

100%

AI Actions Logged

Every FlowAgent and MCP request captured with full attribution.

Annual

Third-Party Penetration Tests

Results available through the Trust Center on request.

TLS 1.2

Encryption in Transit

All data encrypted with SHA-256 certificates end to end.

Deployment Flexibility

Run Itential Where Your Security Model Requires

Itential’s fully managed SaaS platform is the fastest path to production, no infrastructure to provision, no software to maintain. For organizations with regulatory or security requirements that demand complete control, self-managed deployment options are available with validated designs for every configuration.

Explore SaaS Architecture & Security View Validated Designs

Fully Managed SaaS

Get a fully hosted Itential instance up and running in minutes. No servers to provision, no maintenance windows, no manual updates. Just orchestration at scale from day one.

Self-Managed Deployment

For regulated environments that require complete control over data and execution, Itential supports on-premises and private cloud deployment with the same full platform capabilities.

Validated Designs

Production-proven deployment patterns for every requirement, from single-region high availability to active/standby to full multi-region disaster recovery. No guesswork, just architectures that work.

Open & Auditable

Open Standards, Not Proprietary Lock-In

Itential is built on open standards so security teams can inspect, verify, and govern what flows through the platform. Open REST API exposed under the same RBAC as every other action. 1,000+ pre-built integrations, no shadow IT shortcuts. Open MCP for AI systems, governed and audited the same way every other call is. No proprietary lock-in. No black-box AI connectors.

Explore the Community Explore Itential MCP Server

Open REST API, Governed Access

Itential’s REST API powers every integration, including the MCP Server and Spec-Driven Development. Open, documented, and governed under the same RBAC, approval gates, and audit trail as every other action.

1,000+ Open Source Integrations

1,000+ open source integrations through the Itential Marketplace. Vendor-agnostic, version-controlled, and run through the same governance every other action gets. No proprietary shortcuts, no shadow IT integrations bypassing security.

Open MCP for AI, With Audit Trails

The Itential MCP Server connects AI systems through the Model Context Protocol, an open standard. Every AI request schema-validated, RBAC-enforced, and logged before infrastructure is touched. Open standard. Enterprise guardrails.

Why Itential

Real Outcomes. Proven in Production.

Why Customers Choose Itential

Velocity

Services in minutes. Change windows that close. Backlogs that shrink.

Security

Every change governed. Every action auditable. Every AI agent controlled.

Scale

More infrastructure. Same team. No tribal knowledge required.

AI Readiness

Agents that reason. Governed, traceable, and production-ready.

When you’re operating infrastructure at Lumen’s scale, the question was never whether AI could help – it was whether we could trust it in production. FlowAI answered that. Our teams were building production-ready agents in minutes, within the same governance and access controls we already rely on. As we build the next digital backbone for AI, this is the next evolution in our journey with Itential – and it’s redefining how we operate networks at scale.

Greg Freeman

VP Network & Customer Transformation

350+

Live Workflows

57,000+

Actionable Alerts (from 1B+)

80%

Machine-to-Machine Goal

Enterprise activation went from 45 days to less than one – but the bigger shift is that it now runs the same way every time, no matter who’s executing it.

VP, Global Enterprise Services

25x

Network Change Productivity

98%

Fewer Manual-Error Faults

100k+

Days of Accelerated Revenue

Itential definitely is one of the products that has helped us massively in delivering innovation quickly. The support, the technical features, the level of innovation Itential is bringing in this space – that’s what’s accelerated us.

Shirish Basant Rai

Network Platforms & Systems Architect

Weeks

For New Service Rollout vs Months

Continents Standardized Operations on Itential

Zero

Lag on New Services

Itential has been instrumental in our journey to modernize and automate SCE’s network infrastructure. By providing a centralized orchestration platform, we’ve been able to create a vendor-agnostic automation framework that scales across our entire network – from Zero Touch Provisioning for Cisco refreshes to MPLS transport, firewalls, and beyond. With automation at the core of our strategy, we’re not just improving efficiency-we’re redefining how utilities manage network operations in the age of AI and digital transformation.

Matt Deibel

Manager – Grid Automation Services

1k+

Manual Hours Eliminated Per Month

Same Day

New Site Activation

80%

Reduction in Manual Effort

The ability to show tangible results – time saved, faster delivery, productivity gains -has been instrumental in driving automation adoption across our organization. Management loves the data, and that’s what’s secured buy-in for further investment.

Eric Anderson

Senior Infrastructure Architect

15,324

Productivity Time Returned to the Business

10min

Time to deliver new IT Service Requests

7,114

Days of Wait Time Eliminated for Infrastructure Services

The game-changer for us with Itential is how it abstracts the complexity of automation. In the past, scripting and automation were intimidating because they required you to be a programmer first and a network engineer second. But with Itential, you don’t need to be a developer to create impactful automations. You can take building blocks and create workflows that solve real problems quickly and effectively, without the need for manual intervention.

Uzair Khan

Manager of Network Services

Mins

For IP Reservations Across the Device Estate

30+

Remote Sites Standardized & Automated

Same Day

Delivery of Network Services

Itential has given us the ability to take a consistent, scalable approach to network automation across our global environment. By integrating with our existing tools and simplifying the way we manage change, we’re able to execute on a large-scale refresh initiative while staying within our current staffing model.

Chris Healy

Director of LAN/WAN – Campus

5,000

Devices Refreshed with Itential

100%

Self-Service for Federated Site Teams

Zero

Headcount Added

Greg Freeman

VP Network & Customer Transformation

350+

Live Workflows

57,000+

Actionable Alerts (from 1B+)

80%

Machine-to-Machine Goal

Enterprise activation went from 45 days to less than one – but the bigger shift is that it now runs the same way every time, no matter who’s executing it.

VP, Global Enterprise Services

25x

Network Change Productivity

98%

Fewer Manual-Error Faults

100k+

Days of Accelerated Revenue

Shirish Basant Rai

Network Platforms & Systems Architect

Weeks

For New Service Rollout vs Months

Continents Standardized Operations on Itential

Zero

Lag on New Services

Matt Deibel

Manager – Grid Automation Services

1k+

Manual Hours Eliminated Per Month

Same Day

New Site Activation

80%

Reduction in Manual Effort

Eric Anderson

Senior Infrastructure Architect

15,324

Productivity Time Returned to the Business

10min

Time to deliver new IT Service Requests

7,114

Days of Wait Time Eliminated for Infrastructure Services

Uzair Khan

Manager of Network Services

Mins

For IP Reservations Across the Device Estate

30+

Remote Sites Standardized & Automated

Same Day

Delivery of Network Services

Chris Healy

Director of LAN/WAN – Campus

5,000

Devices Refreshed with Itential

100%

Self-Service for Federated Site Teams

Zero

Headcount Added

Keep Learning

Dive Deeper Into the Itential Platform

Guides & Whitepapers

Architecting Hybrid AI for Infrastructure Operations

Blogs

Mapping Itential Platform Technologies to the AI Infrastructure Journey

Blogs

451 Research Validates FlowAI as the Foundation for Autonomous, Governed Infrastructure Operations

Blogs

Enterprise Infrastructure Is Ready for Agentic Operations, Most Platforms Are Not

Blogs

Build Time vs Runtime in Agentic Operations

Get Started

Bring Your Security Team. We’re Ready.

See how Itential passes enterprise security reviews and governs every action, human or AI, through one platform.

Talk to an Expert

Frequently Asked Questions

–+

AI agents in Itential never touch infrastructure directly. Every agent-proposed action flows through Itential’s deterministic orchestration engine, with governed execution, approval gates, pre/post validation checks, blast-radius limits, and full audit trails. AI adds reasoning. Itential adds the guardrails.

–+

Itential uses two separate access control layers for AI agents. At the project level, the builder assigns Owner, Editor, or Viewer roles to groups, controlling who can view, modify, or delete the agent definition. At the agent level, the builder assigns a separate list of operator groups permitted to run the agent. Users not in those groups cannot invoke the agent, see its sessions, or configure triggers. Both layers use the same group-based access control model already governing every other platform asset. External MCP tools registered through the FlowMCP Gateway inherit the same RBAC model.

–+

Each FlowAgent has an explicit allowlist of platform capabilities selected from the Tool Registry at design time. That list is locked and validated at runtime by the execution engine. If an agent attempts to call anything outside its registered tool set, the request is rejected before it dispatches. Agents cannot escalate beyond their granted scope, even if prompted to.

–+

No. Customer configurations, telemetry, and operational data are never shared with or used to train any external AI model. The Itential MCP Server connects to external AI systems for execution, not for training. What runs on your platform stays on your platform.

–+

Credentials and secrets remain in customer-controlled vaults or local secrets management, never in agent definitions, workflows, or execution logs. Itential injects secrets at runtime only and they are not exposed in agent context. Supported integrations include HashiCorp Vault, CyberArk, AWS Secrets Manager, and Azure Key Vault.

–+

Itential never stores copies of your infrastructure data. Your existing systems of record (IPAM, CMDB, source control, device configs) remain the source of truth at all times. Itential reads from and writes to those systems through governed workflows without creating a separate data store. Your data stays where it lives.

–+

Itential is SOC 2 Type II certified, GDPR and CCPA compliant, and encrypts all data in transit and at rest. We conduct regular penetration testing and maintain a full Trust Center with documentation available for enterprise review. SOC 2 reports are available upon request.

–+

Itential is SaaS-first. Our fully managed cloud platform gets you running in minutes with no infrastructure to provision or maintain. For organizations with regulatory or security requirements that demand complete control, self-managed on-premises and private cloud deployment options are available. Validated designs cover everything from single-region high availability to full multi-region disaster recovery.

–+

The Itential MCP Server is built on Itential’s open REST API and connects external AI systems to governed infrastructure workflows through the Model Context Protocol. It translates AI intent into validated, auditable actions, ensuring any AI system interacting with your infrastructure operates within the same security, compliance, and governance boundaries as human-initiated changes.

–+

No. Itential is an orchestration layer that integrates with what you have, not a replacement. Your Ansible playbooks, Python scripts, Terraform plans, ServiceNow workflows, and existing monitoring stack all stay in place and become governed services on the Itential Platform. 1,000+ pre-built integrations across ITSM, monitoring, configuration, and infrastructure platforms.