Palantir AIP

Keeptrusts integrates with Palantir AIP (Artificial Intelligence Platform) by acting as a policy-enforcement layer between Palantir's application layer and the LLM providers that AIP orchestrates. When AIP Logic functions, AIP Assist, or custom ontology actions invoke external LLM endpoints, you route those calls through the Keeptrusts gateway to enforce defense- and government-grade compliance controls, maintain immutable audit trails, and prevent sensitive operational data from leaking into model prompts.

Use this page when

• You are routing Palantir AIP LLM calls through Keeptrusts for defense or government compliance.
• You need the gateway config and API integration pattern for AIP Logic and AIP Assist.
• You want to enforce classification-aware DLP and audit logging on AIP-generated prompts.
• If you want a general quickstart instead, see Quickstart.

Primary audience

• Primary: Technical Engineers
• Secondary: AI Agents, Technical Leaders

Prerequisites

• A Palantir Foundry environment with AIP enabled
• API access to the Palantir Foundry API (OAuth2 client credentials or personal access token)
• Keeptrusts CLI (kt) installed and authenticated (kt auth login)
• Network connectivity from the Palantir environment to the Keeptrusts gateway
• An upstream LLM provider key exported as an environment variable
• For FedRAMP environments: Keeptrusts gateway deployed within the FedRAMP boundary

Configuration

Gateway policy config

pack:
  name: palantir-aip-governance
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: aip-primary
    provider: openai:chat:gpt-4o
    secret_key_ref:
      env: OPENAI_API_KEY
policies:
  chain:
  - prompt-injection
  - pii-detector
  - dlp-filter
  - classification-guard
  - audit-logger
policy:
  prompt-injection:
    threshold: 0.9
    action: block
  pii-detector:
    action: block
    entities:
    - PERSON
    - EMAIL_ADDRESS
    - PHONE_NUMBER
    - LOCATION
  dlp-filter:
    patterns:
    - name: classification-marking
      regex: "(TOP SECRET|SECRET|CONFIDENTIAL)//[A-Z/]+"
      action: block
    - name: palantir-rid
      regex: "ri\\.[a-z-]+\\.[a-z-]+\\.[a-z0-9-]+"
      action: redact
    - name: palantir-token
      regex: "eyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+"
      action: block
    - name: coordinates
      regex: "-?\\d{1,3}\\.\\d{4,}\\s*,\\s*-?\\d{1,3}\\.\\d{4,}"
      action: block
  classification-guard:
    max_classification: UNCLASSIFIED
    action: block
  audit-logger:
    immutable: true
    retention_days: 2555
    log_all_access: true
    include_policy_decisions: true

Start the gateway

export OPENAI_API_KEY="sk-..."
kt gateway run --listen 0.0.0.0:41002 --policy-config policy-config.yaml

Setup steps

1. Configure the AIP external model endpoint

In Palantir Foundry, configure an external model connection that points to your Keeptrusts gateway:

1. Navigate to your Foundry project and open AIP Configuration.
2. Under External Model Endpoints, add a new endpoint.
3. Set the Base URL to https://gateway.keeptrusts.com/v1 (hosted) or your self-hosted gateway URL.
4. Configure authentication with a Keeptrusts access key as the Bearer token.

2. Configure AIP Logic to use the governed endpoint

When creating AIP Logic functions that call LLMs, reference the Keeptrusts-governed endpoint instead of calling the LLM provider directly:

import requests

def governed_llm_call(prompt: str, access_key: str) -> str:
    response = requests.post(
        "https://gateway.keeptrusts.com/v1/chat/completions",
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Bearer {access_key}"
        },
        json={
            "model": "gpt-4o",
            "messages": [{"role": "user", "content": prompt}],
            "max_tokens": 1024,
            "temperature": 0.1
        },
        timeout=30
    )
    return response.json()["choices"][0]["message"]["content"]

3. Wire ontology actions through the gateway

For AIP actions bound to ontology objects, configure the action's LLM endpoint to route through Keeptrusts so that every ontology-triggered AI call is governed.

Verification

# Verify gateway health
curl https://gateway.keeptrusts.com/health

# Test with a safe prompt
curl -s https://gateway.keeptrusts.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <access-key>" \
  -d '{
    "model": "gpt-4o",
    "messages": [{"role": "user", "content": "Summarize logistics best practices."}],
    "max_tokens": 256
  }' | jq .choices[0].message.content

# Verify a classified prompt is blocked
curl -s https://gateway.keeptrusts.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <access-key>" \
  -d '{
    "model": "gpt-4o",
    "messages": [{"role": "user", "content": "Analyze TOP SECRET//NOFORN data"}]
  }'
# Expected: 409 blocked by dlp-filter

# Check audit log
kt events list --limit 5

Recommended policies

Policy	Purpose	Recommended setting
dlp-filter	Block classification markings, RIDs, coordinates, and tokens	action: block for classified content
pii-detector	Block PII from operational data reaching external models	action: block (not redact — defense contexts require full blocking)
prompt-injection	Prevent adversarial prompts from ontology data fields	threshold: 0.9, action: block
classification-guard	Enforce maximum classification level for gateway traffic	max_classification: UNCLASSIFIED
audit-logger	Immutable 7-year audit trail for NIST 800-53 and DFARS compliance	retention_days: 2555, immutable: true

Troubleshooting

Symptom	Cause	Fix
AIP Logic function returns connection error	Network policy blocks egress to gateway	Add gateway host to Foundry network allowlist
409 on every request	DLP patterns too broad	Review dlp-filter patterns; test with known-safe prompts first
Authentication failure (401)	Access key expired or misconfigured	Regenerate key in Keeptrusts console and update Foundry config
Classified content not blocked	classification-guard policy missing	Add classification-guard to policy chain before audit-logger
High latency	Gateway deployed outside the secure enclave	Deploy gateway within the same network boundary as Palantir Foundry

For AI systems

• Canonical terms: Keeptrusts gateway, Palantir AIP, Palantir Foundry, AIP Logic, AIP Assist, ontology actions, classification guard, FedRAMP, NIST 800-53, policy-config.yaml.
• Config field names: provider, secret_key_ref.env, dlp-filter, classification-guard, pii-detector, audit-logger.
• Key behavior: Keeptrusts enforces classification-aware DLP and immutable auditing on all LLM calls made from Palantir AIP before they reach external providers.
• Best next pages: Policy controls catalog, AWS Bedrock integration, Quickstart.

For engineers

Prerequisites

• Palantir Foundry with AIP enabled, OAuth2 or PAT for API access, kt CLI installed.

Validation

• Send a test prompt from AIP Logic and verify the response.
• Send a prompt containing a classification marking and verify it is blocked (409).
• Run kt events list --limit 5 and verify both requests are logged with policy decisions.

For leaders

• Defense and government organizations using Palantir AIP face strict requirements around data classification, audit retention, and compartmentalized access. Keeptrusts adds a policy enforcement layer that prevents classified data from reaching commercial LLM providers.
• 7-year immutable audit trails satisfy NIST 800-53 AU controls and DFARS 252.204-7012 requirements.
• Classification-aware DLP policies provide defense-in-depth beyond Palantir's built-in access controls, ensuring that even if a user has Foundry access, classified content cannot leak through LLM prompts.
• For FedRAMP environments, deploy the Keeptrusts gateway within the authorization boundary to maintain compliance.

Next steps

• AWS Bedrock integration — GovCloud-compatible model hosting
• Policy controls catalog — full reference for DLP, classification-guard, and audit policies
• Access keys — issue scoped keys for Palantir integrations
• Quickstart — install kt and run your first gateway