Skip to content

Rules Engine

The AI Controller Rules Engine provides powerful, fine-grained control over how LLM requests are handled by the system, ensuring your organization can enforce appropriate access policies for AI technologies.

Rules Engine Overview

The Rules Engine implements governance and access controls for all AI interactions. It intelligently applies your organization's policies in real-time to determine:

  • Whether a specific request is allowed to proceed
  • Which models and providers are accessible to specific users or groups

Rules are evaluated for each incoming request, ensuring consistent policy enforcement without requiring changes to your applications or client code. For details on how the Rules Engine fits into AI Controller's architecture, see Architecture Overview.

flowchart BT
    %% Main colors that work well on both light and dark backgrounds
    classDef client fill:#B3E5FC,stroke:#0288D1,color:#01579B
    classDef gateway fill:#C8E6C9,stroke:#43A047,color:#1B5E20
    classDef rules fill:#FFECB3,stroke:#FFA000,color:#E65100
    classDef ruleCache fill:#FFE0B2,stroke:#FB8C00,color:#E65100
    classDef decision fill:#E1BEE7,stroke:#8E24AA,color:#4A148C
    classDef action fill:#FFCCBC,stroke:#FF7043,color:#BF360C
    classDef provider fill:#C5CAE9,stroke:#5C6BC0,color:#1A237E
    classDef component fill:#F5F5F5,stroke:#9E9E9E,color:#212121

    Client[Client Application]:::client -->|1. API Request| AIC[AIC API Gateway]:::gateway
    AIC -->|2. Intercepts Request| RE[Rules Engine]:::rules

    subgraph Rules_Evaluation["Rules Evaluation Process"]
        RE -->|3. Check In-Memory Rules| RM[Rules Memory Cache]:::ruleCache
        RE -->|4. Evaluate Request| Decision{Rule Match?}:::decision
    end

    Decision -->|5a. Yes| Allow[Allow Request]:::action
    Decision -->|5b. No| Deny[Deny Request]:::action

    Allow -->|6a. Forward Request| Providers[LLM Providers]:::provider
    Providers -->|7. Response| AIC

    Deny -->|6b. 400 Bad Request| AIC

    AIC -->|8. API Response| Client

Diagram showing the flow of requests through the Rules Engine, with requests being evaluated against in-memory rules before being routed to providers. To understand how this fits into the complete request flow, see Data Flow.

Business Benefits

Fine-Grained Access Control

Control which users and groups can access specific AI models and providers, ensuring appropriate AI capabilities for different roles and departments.

Cost Management

Limit access to expensive, high-powered models to only those users who genuinely need them, helping to control AI spending.

Risk Mitigation

Prevent inappropriate AI use by restricting certain models or capabilities to approved users only, reducing compliance and misuse risks.

Consistent Policy Enforcement

Apply organizational AI policies uniformly across all applications and user interfaces without modifying each application individually.

Common Use Cases

Departmental AI Policies

Create customized AI experiences for different departments based on their specific needs:

  • Marketing: Access to content generation and customer-facing creative models
  • Engineering: Access to code-specialized models for development assistance
  • Finance: Access to data analysis and forecasting models with appropriate controls
  • Customer Service: Access to knowledge base models with appropriate guardrails

Cost-Tiered Access

Structure AI access based on cost and capability requirements:

  • Reserve premium, high-cost models for specialized teams with appropriate business justification
  • Provide cost-effective models for general use cases across the organization
  • Balance performance needs with budget considerations

Risk Management

Implement governance controls to mitigate risks. These controls are part of AI Controller's comprehensive governance framework and security model.

  • Restrict vision-capable models to appropriate use cases and teams
  • Control access to models that might process sensitive information
  • Enforce compliance with industry regulations and internal policies

Integration with Other AI Controller Features

API Key Management

Rules work in conjunction with API Keys to provide comprehensive access control:

  • API Keys authenticate applications and services
  • Rules determine what those applications can access
  • Together they create a robust security model

See API Key Management for more details on this integration.

Caching Integration

The Rules Engine seamlessly integrates with AI Controller's caching system, ensuring that access controls remain effective while still benefiting from performance optimizations.

Logging and Auditing

Rules Engine activity is comprehensively logged to provide an audit trail for compliance and security purposes, giving you complete visibility into who is accessing what AI capabilities.

Updated: 2025-05-15