UiPath Platform™ Governance extends the identity, audit, and compliance infrastructure your enterprise already trusts across every agent, model, and action. Independently proven by AIUC-1 and ISO/IEC 42001.
UiPath Platform™ Governance extends the identity, audit, and compliance infrastructure your enterprise already trusts across every agent, model, and action. Independently proven by AIUC-1 and ISO/IEC 42001.
One control plane governs every agent, every model, and every action across the platform.
What AI Trust means in practice.
Your data never trains a model and never leaves approved boundaries. In-flight PII masking redacts personal identifiers before any prompt reaches an external model. Zero third-party retention across approved providers.
Every agent action, model invocation, prompt, response, and approver is logged in a tamper-evident audit trail. The same evidence regulators ask for and internal audit needs to sign off.
Schellman ran 2,000+ adversarial scenarios across UiPath IXP, Agents, and Autopilot under AIUC-1. Re-tested every quarter. Behavioral proof vs. evolving risks.
The AIUC-1 standard, the adversarial scenarios behind it, and what they mean for an enterprise deploying agents.
UiPath is the first enterprise automation company to achieve AIUC-1 certification. To achieve this, they subjected their suite of agentic AI systems to 2,000+ technical evaluations, and a comprehensive audit of their AI policies and technical guardrails.
Manage the LLM lifecycle across the platform: validation, geo-residency, version control, and deprecation. Behavioral baselines validate every model before promotion, and affected workflows surface automatically when a model is deprecated.
Tamper-evident audit logs record every agent action with full TraceID across platform objects. In-flight PII masking redacts personal identifiers before prompts reach external models, on every interaction.
Manage the LLM lifecycle across the platform: validation, geo-residency, version control, and deprecation. Behavioral baselines validate every model before promotion, and affected workflows surface automatically when a model is deprecated.
Tamper-evident audit logs record every agent action with full TraceID across platform objects. In-flight PII masking redacts personal identifiers before prompts reach external models, on every interaction.
Bring your own model under one policy plane. OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, or customer-hosted. Vendor-agnostic governance for hybrid model strategies.
Define and remix governance dashboards using coding agents. Export to SIEM, Microsoft Agent365, and BI tools via OpenTelemetry. Governance data flows into the stacks you already operate.
Bring your own model under one policy plane. OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, or customer-hosted. Vendor-agnostic governance for hybrid model strategies.
Define and remix governance dashboards using coding agents. Export to SIEM, Microsoft Agent365, and BI tools via OpenTelemetry. Governance data flows into the stacks you already operate.
Author policies in code or low-code, version them in Git, and enforce them at runtime across access, guardrails, cost, geo, content, lifecycle, and audit. The same framework applies to every agent on every platform.
Trust, velocity, and scale built into the platform that runs your agents and robots. No separate enforcement layer to procure, no overlay to integrate.
ISO/IEC 42001, AIUC-1, SOC 2 Type II, FedRAMP Moderate, and more. Certified by outside auditors and re-tested every quarter.
Policies authored in VS Code or low-code, versioned in Git, enforced at runtime across access, guardrails, cost, geo, content and safety, lifecycle, and audit. One policy framework, every agent, any platform.
Jailbreak protection, prompt injection defense, tool restrictions, allow/deny lists, and PII masking enforced from a single policy surface. The same controls apply on every model invocation, every agent action.
Tamper-evident logs capture every agent action, prompt, response, tool call, model version, and human approver. Export audit and traces to your preferred SIEM, observability, and your GRC platforms.
Policies authored in VS Code or low-code, versioned in Git, enforced at runtime across access, guardrails, cost, geo, content and safety, lifecycle, and audit. One policy framework, every agent, any platform.
Jailbreak protection, prompt injection defense, tool restrictions, allow/deny lists, and PII masking enforced from a single policy surface. The same controls apply on every model invocation, every agent action.
Tamper-evident logs capture every agent action, prompt, response, tool call, model version, and human approver. Export audit and traces to your preferred SIEM, observability, and your GRC platforms.
ISO/IEC 42001, AIUC-1, SOC 2 Type II, ISO/IEC 27001, FedRAMP Moderate (Automation Cloud for Public Sector), HIPAA, IRAP, HITRUST, ISO 9001, Cyber Essentials Plus.
Run automation at enterprise scale without exposing your network. Relay bridges Automation Cloud to on-premises systems without inbound firewall rules. Azure Private Link keeps cloud traffic inside your Virtual Network. AES-256 encryption and customer-managed keys via Azure Key Vault ensure your data stays yours, in transit and at rest.
ISO/IEC 42001, AIUC-1, SOC 2 Type II, ISO/IEC 27001, FedRAMP Moderate (Automation Cloud for Public Sector), HIPAA, IRAP, HITRUST, ISO 9001, Cyber Essentials Plus.
Run automation at enterprise scale without exposing your network. Relay bridges Automation Cloud to on-premises systems without inbound firewall rules. Azure Private Link keeps cloud traffic inside your Virtual Network. AES-256 encryption and customer-managed keys via Azure Key Vault ensure your data stays yours, in transit and at rest.
The same control plane looks different through each role, but every action is logged, every policy is enforced, and every decision is traceable.
ROLE
Set the standard, see the whole estate
Configure identity, RBAC, and tenant boundaries across the platform. Provision agents, robots, and people under one policy framework with SAML 2.0, OIDC, and SCIM. See every action across every agent in every tenant.
Org Admin
ROLE
Govern models, guardrails, and the AI Trust Layer
Approve models, set behavioral baselines before promotion, and enforce guardrails on every prompt and response. Manage the AI Trust Layer for UiPath and bring-your-own models alike, with deprecation workflows that flag affected automations.
AI Admin
ROLE
Build inside the guardrails, ship faster
Author Policy-as-Code in VS Code, version it in Git, and run against the same enforcement engine production uses. Build agents that inherit the right credentials, the right tools, and the right boundaries by default.
Developer
ROLE
Regulator-ready evidence on demand
Pull the full record of every agent action, prompt, response, and human approval with cryptographic integrity. Map the platform to EU AI Act, NIST AI RMF, ISO/IEC 42001, and SOC 2 controls without rebuilding the trail.
Auditor
SOLUTION ACCELERATOR
File threat detection and response, ready to deploy from UiPath Marketplace.
TRUST CENTER
Every certification and security report in one place: ISO, SOC, FedRAMP, HIPAA, AIUC-1, and more.
With Automation Cloud™, you get the full UiPath Platform™, the fastest updates—and the scalability and flexibility to automate any process, anywhere you do business.
Start here
Run the platform yourself, with the world-class automation capabilities you expect and the performance, compliance, and security you require.
Start hereHow AI agents are governed, audited, and certified on the UiPath Platform.
The AI Trust Layer governs any model. OpenAI, Anthropic, Google, Meta, AWS Bedrock, Azure OpenAI, or your own. Policy-as-Code enforcement, PII masking, and audit apply the same way, no matter who built the model.
AIUC-1 is an adversarial, behavioral standard. Schellman ran 2,000+ scenarios across prompt injection, data exfiltration, hallucination triggers, and tool misuse against UiPath IXP, Agents, and Autopilot. Re-tested every quarter. ISO/IEC 42001 validates governance; AIUC-1 validates behavior.
Tamper-evident, append-only logs capture every agent action, prompt, response, tool call, model version, and human approver. Cryptographic integrity via AWS CloudTrail or Azure Immutable Blob. Exportable to SIEM (Splunk, Microsoft Sentinel, Chronicle) and GRC platforms via OpenTelemetry.
ISO/IEC 42001, AIUC-1, ISO/IEC 27001, SOC 2 Type II, HIPAA, FedRAMP Moderate, IRAP, HITRUST, ISO 9001, Cyber Essentials Plus. AIUC-1 operationalizes the EU AI Act, NIST AI RMF, MITRE ATLAS, and OWASP LLM Top 10.
Bring-your-own-model is governed by the same AI Trust Layer that governs UiPath agents. Approved models, behavioral baselines, PII masking, and audit apply on every invocation. Unapproved model calls are blocked at the control plane.
Yes. UiPath Automation Cloud for Public Sector holds FedRAMP Moderate. Automation Suite supports air-gapped and on-premises deployments for sovereign and intelligence environments. Regional data residency is available across Automation Cloud regions.
