forigi / for-it · governance

Approve innovation. Without losing control.

Your teams will ship AI-built tools this year with or without a sanctioned path. Forigi is the runtime that makes the sanctioned path the easy one — under policy you set once.

01Your consoleThis is the product — not an add-on tier.

Every app, every data flow, one screen.

A tenant-scoped console that lists every app your teams have shipped, streams the audit feed, and puts a kill switch on every row.

app.forigi.com/admin — yourco.com tenantadmin · j.whitfield
Apps24
Sign-ins · 24h1,247
Policy violations0
p95 latency218ms
shipment-trackerOps · M. Alvarez
sharepoint:/opslive
pto-calendarHR · D. Okafor
per-app db onlylive
vendor-quotesProcurement · S. Patel
onedrive:/procurementlive
churn-dashboardCS · L. Romero
sharepoint:/cspaused
policy: enforcedsso: entra-idaudit: streamingkill switch: every row
02What you controlEverything with a blast radius.

Every read, write, and external call — under your policy.

Governed data sourcesYou publish which SharePoint and OneDrive sources apps may touch. Apps read them as the signed-in viewer, never a service account — M365 permissions stay the single source of truth.allowlist
Full audit trailEvery read, write, and external call, with actor, app, scope, and timestamp. “What data went where, by whom” takes seconds, not a forensics engagement.who · what · when
Kill switchPause or delete any app instantly. Sessions revoke immediately, viewers see a maintenance notice, and the action is logged.instant
Per-tenant policyData-source allowlist, per-app source binding, rate limits, audit retention, and deploy-time bundle rules — set once, inherited by every app automatically.set once
Constrained runtimeApps are static bundles: no credentials, no cross-origin calls, no server code. The biggest vibe-code failure modes are structurally impossible, not merely monitored.csp-enforced
Verified publisherOperated by Knotbook Software Inc., a Microsoft AI Cloud Partner Program member with verified-publisher status on the Entra app registration.microsoft
03The realityThird-party findings, cited as published.

Shadow AI is a visibility problem before it’s a policy problem.

93%of C-suite leaders are concerned about vibe-coded tools in production; only 8% report strong governance over them.Retool, 2026
75%of CISOs have already found unsanctioned GenAI tools in their environment.CISO AI Risk Report, 2026
$670Kadditional cost per breach when shadow AI is involved.IBM, 2025

When Escape.tech scanned 5,600 production vibe-coded apps, they found 2,000 critical vulnerabilities, 400 exposed secrets, and 175 instances of exposed PII. Forigi’s runtime forecloses the largest categories by design: apps can’t hold credentials, can’t make cross-origin requests, and read data only as the signed-in viewer. The full architecture is public.

04QuestionsWhat IT always asks.
How does Forigi keep our data safe?

Apps are static HTML and JavaScript only — they cannot make cross-origin requests, hold credentials, or run server code. All data access flows through a constrained SDK the platform controls, and identity propagates to source systems, so viewers see only what their existing Microsoft 365 permissions allow.

What exactly can IT control?

Which data sources are exposed to apps, which apps can bind to which sources, per-app rate limits, audit retention, bundle-security policy enforced at deploy time, and a kill switch on every app. Policy is per-tenant and applies to every app automatically.

Where do apps run?

On Forigi's hosted runtime, at URLs gated by your Microsoft Entra ID SSO. Apps live behind your identity boundary — a viewer who isn't signed into your tenant never reaches the app.

Does adopting Forigi mean endorsing shadow IT?

The opposite. Employees are already building AI tools — the industry numbers on this are unambiguous. Forigi replaces invisible, ungoverned deployment paths with one path you can see, scope, audit, and revoke. It converts shadow IT into governed self-service.

What's in the pilot today, honestly?

Microsoft SSO via Entra ID; SharePoint and OneDrive as governed sources with viewer-identity, read-only access; per-app databases with staged, additive-only schema changes; full audit; per-tenant policy; kill switch. More Microsoft sources are on the roadmap. If you need something that isn't listed here, ask us directly — we'd rather lose a pilot than overstate scope.

Who's behind Forigi?

Knotbook Software Inc., a Microsoft AI Cloud Partner Program member with verified-publisher status on its Entra app registration. The team has sat on both sides of this problem — as builders stuck behind ticket queues, and as the people who understand why those queues exist.

Get ahead of the apps that are coming anyway.

Thirty minutes with a founder: governance fit, pilot scoping, and the kill switch used live. We take on a small number of pilot teams each quarter.

Microsoft verified publisherEntra ID SSO on every appEvery action loggedKill switch on every app