Lumenova AI is an agentic AI governance and security company. It gives enterprises in regulated industries, such as banking, insurance and life sciences, a way to decide what their AI agents may do, record every step they take and explain the outcome to auditors and regulators.
Policy applies to each agent call rather than to the agent as a whole, so a single tool invocation, parameter or handoff to another agent can be allowed or refused before it executes.
At A Glance
| Vendor | Lumenova AI |
|---|---|
| Category | Agentic AI governance and security |
| Identities covered | AI agents, MCP servers, API keys, users and teams |
| Deployment | AI Gateway self-hosted inside the customer perimeter, production infrastructure cloud-hosted |
| Agentic AI | Agent registry, tool control, multi-agent tracing, probe evaluations |
| Certifications | SOC 2 Type II, ISO/IEC 27001:2022 |
| Market classification | AI Governance & Compliance |
What Lumenova AI Does
Governance teams adopting agents face three questions: which agents exist and who approved them, what each one is allowed to do, and how it behaves over time. Lumenova answers the first with a registry and lifecycle records, the second with a gateway and policy engine, and the third with evaluations and tracing. Red and blue team testing sits alongside.
Records export as audit evidence for GRC teams, and controls map to the EU AI Act, NIST AI RMF, ISO/IEC 42001, Colorado insurance rules and OSFI E-23.
Products
AI Inventory & Registry
The registry is where governance starts. Teams register agents, MCP servers, skills and prompts, with versions and approvals tied to each use case, and track each agent’s status, approvers and policy stack. An agent that has not been registered is stopped at the gateway until it is, which brings shadow AI into view.
AI Gateway And AI Policy Engine
The gateway is the enforcement point for platform teams that need to control agent actions without rewriting them. Rules are policy as code, and “a policy decides whether the action runs, before it runs”. Budget ceilings and rate limits apply per key, team and user. Adoption means swapping the base URL an agent calls.
AI Guardrails And AI Security
These modules stop harmful input and output. They detect prompt injection before it reaches the model, block, mask or redact personal data before the model sees it, and filter harmful content and restricted topics.
AI Evaluations
Evaluations test whether agents are fit for use, through continuous runs, version comparisons, rule checks, quality judgement and whole-workflow review. Probe evaluations attack a running agent with no code access to find what breaks it, and results are classified into weakness classes mapped to the OWASP Top 10 for Agentic Applications and MITRE ATLAS.
AI Risk Assessment Agent
This agent produces a risk assessment report rated in low, medium and high concerns. It explains how each input influences a model decision and measures fairness across intersecting sensitive attributes.
AI Observability, AI Governance And AI Risk Management
These modules cover tracing, alerts, and cost and usage tracking, plus risk and control records. Traces follow a workflow through every agent and tool it touches, and records export as CSV or JSON for GRC platforms.
How It Works
Calls pass through two layers. Policies are written in Open Policy Agent, traces use OpenTelemetry, and platform users sign in with single sign-on and role-based access. Detection & Discovery runs first and inspects what the agent sends and receives for injection, personal data, harmful content and factual accuracy. Enforcement & Remediation follows and governs tool access, parameters, budgets and handoffs.
The gateway is self-hosted inside the customer’s perimeter, so prompts and completions stay on the customer network and masking runs there too. The rest of the production service is cloud-hosted with a service provider. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256 or higher, backed up daily, and customer data is kept out of development.
Identities And Systems Covered
| AI agents | Registered with versions and approvals, and traced across every agent and tool in a workflow. |
|---|---|
| MCP servers, skills and prompts | Held in the inventory alongside the agents that use them. |
| Keys, teams and users | Spend is attributed to each one, and the attribution stays on the record after a key is deleted. |
| Directory accounts | Revoking a user in the existing directory stops their access at the gateway. |
Company Background
| Founders | Cosmin Andriescu, co-founder, President and CTO; Andrei Manea, co-founder and Chief Scientist. |
|---|---|
| Security | SOC 2 Type II audit covering security, confidentiality and availability, and conformity with ISO/IEC 27001:2022. |
| Recognition | Included in the GOV.UK portfolio of AI Assurance Techniques (April 2024) as a SaaS solution for governing AI systems at enterprise level. |
Note: This overview is compiled from Lumenova AI’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.