Zero trust governance

Verify every AI action. Trust nothing by default.

Holiday checks every tool call against both the AI identity’s permissions and the requesting user’s permissions. Trust rules enforced in code decide what can proceed, and every action is recorded.

Book a demonstration Understand Our Environment Review Trust & Security

Trust architecture

Make every identity, permission and action accountable.

AI is arriving through employee tools, software features and autonomous services. As adoption spreads across departments, each new entry point creates questions about access, cost and ownership.

Holiday ties approved AI work to an identifiable requesting user, digital employee or specialist, defined authority and a visible operating history. Models can request actions, but they cannot grant themselves access.

The trust boundaries are enforced in the application layer, independently of the model. Identity and access signals also help teams investigate possible Shadow AI or unregistered agents.

AI activity

See exactly what was accessed, who instructed it, who reviewed it and when it happened.

Holiday maintains a traceable record of AI activity across the business, connecting each action to the responsible identity, system access, human review and the time it occurred.

Holiday user controls showing roles, data credentials, digital employee access and account permissions.

Governance reporting

Follow a task from instruction to outcome.

Review who started the work, what the AI accessed, which decisions needed approval and what happened next.

Requesting user: Who requested or initiated the work.
Digital Employee identity: Which identifiable digital employee owned the work.
Specialist: Which specialist carried out the focused task, when used.
Model/provider used: Which AI model and provider performed the work.
Task/instruction: The job, prompt or instruction received.
Credential used: Which approved credential authorised access.
Systems accessed: Every connected application or service used.
Clients accessed: Which client records or workspaces were involved.
Data/sources accessed: Documents, records and information sources considered.
Actions taken: Every operation performed across connected systems.
Outputs produced: Responses, documents, updates and other deliverables.
Review required: Whether the work required human review.
Reviewer: Who reviewed the work and its supporting record.
Approval/rejection: The decision made and its approval state.
Escalations/reporting: Issues returned for attention and how they were reported.
Final outcome: What was completed, changed or resolved.
Timestamp/history: When each event occurred and the sequence of activity.

User and AI access

Verify both sides of every action.

Every tool call is verified: Holiday checks the AI identity’s authority and the requesting user’s permissions every time, before connected information or systems can be accessed.

User access

Business Chat: Ask questions across the systems and data approved for their role.
Databases: Search only the connected records they are permitted to use.
Digital Employees: Instruct only the digital employees assigned to their account, team or work.
Work access: View and act on approved tasks, clients, projects and responses.

AI access

Approved client data: Use only the client and company information approved for its role.
No borrowed credentials: Reach systems only through approved, scoped connections assigned to that AI identity.
Database permissions: Read, create or update only the permitted records and fields.
Container only: Operate inside the Holiday environment without uncontrolled access across company systems.

Management decides how people reach AI and how AI reaches the business.

Enterprise AI governance

Keep governance consistent as AI use expands.

Holiday works with the software a company already uses. As more teams adopt AI, management can assign responsibilities, permissions and budgets within the same controlled environment.

Leaders can see activity across approved people and digital employees, investigate unusual access, and make changes without rebuilding each team’s tools.

Explore Shadow Agent Detection

Control. Chat. Operate.

Give your AI program an operating framework.

Start with the systems and operating work your business already has.

Book a demonstration