Use Case — Enterprise
AI observability that satisfies security, legal, and audit — not just engineering.
Enterprise AI deployments need access control, audit trails, data governance, and compliance tooling. Here's what Zespan looks like when those requirements are non-negotiable.
The problem
No access control across projects
Multiple teams share AI infrastructure. Any engineer can see any project's traces, prompts, and cost data — including sensitive customer conversations.
No audit trail for AI changes
Compliance requires documentation of every prompt change, guardrail modification, and billing action. You don't have that trail. Auditors will ask.
No proof that outputs are monitored
Legal and security want assurance that AI outputs are actively monitored and controlled. You have logging — not governance.
How to use Zespan for this
Configure SSO in Org Settings
Go to Org Settings → SSO. Enter your OIDC issuer URL, client ID, and client secret (stored encrypted at rest). Enable domain-based routing — users on your email domain are automatically sent to SSO on login. Set a default role (viewer or member) for all SSO-provisioned users. OIDC discovery auto-populates configuration from your issuer URL.
Assign RBAC roles — scope each team to what they need
In Org Settings → Team, assign roles: owner, admin, member, or viewer. Sensitive operations — promoting a prompt to production, changing guardrail config, managing billing — are gated by role server-side. Viewers see dashboards and traces. Only admins can modify production config. Role checks happen on every API route, not just the UI.
Enable guardrails with audit logging
Configure guardrails for PII, toxicity, and any custom LLM rules your compliance team specifies. Every guardrail execution is logged — rule slug, action taken, modified text, latency. Every guardrail config change (create, update, enable, disable) is written to the audit log with actor user ID, IP, and user agent. This is your evidence of active monitoring.
Review the Audit Log — every sensitive action attributed
Open Org Settings → Audit Log. Every sensitive action on the platform is recorded: SSO config changes, prompt label promotions, guardrail modifications, billing events, team membership changes. Each entry shows actor user ID, IP address, and user agent. Export the log for compliance reviews or pipe it to your SIEM.
Handle data subject requests — GDPR Art. 15 and 17
When a GDPR erasure or access request arrives, call the Zespan API: POST /gdpr/erasure-request or /gdpr/dsar-request with the user identifier. The request is queued as a background job with a 30-day deadline tracked. Duplicate requests are blocked. Deadline status is queryable. Your DPO gets a documented, auditable process instead of manual data hunting.
Start free — 10K traces/month, no card needed
See every agent decision, tool call, and handoff in production. Setup takes under 5 minutes.
Get started free →