InterLock is an infrastructure product launched by Context Data, positioned as a proxy layer between AI agents and production data, used to provide governed data access for generative AI applications.
Purpose When AI agents enter the production environment, agent platforms usually only decide which tools an agent can call, but not which data rows those tools can read. InterLock fills this layer: it works at the level where the data itself resides, namely the queries that run, the rows returned, and the writes that change data, and communicates directly using the protocols already in place at the data source.
Main capabilities InterLock provides four types of control for each agent request:
- Role-based access, down to the column: each agent has its own identity and key. Source roles allow or deny operations by source, and for SQL sources down to tables and columns. SQL is parsed before running, and anything the role does not allow is rejected.
- Masking before the agent sees it: personal data in results is detected and masked in the response. Policies can also mask specified columns, rate-limit an agent, or limit its write risk. Policies only narrow permissions and never grant permissions.
- High-risk writes wait for human review: each write is classified by risk before execution. Routine inserts are allowed through; updates, unbounded deletes, and schema changes are queued for a reviewer to approve or reject in the console, with optional Slack notifications.
- Every request leaves a trace: whether allowed or denied, every request is written to an append-only audit log recording identity, source, decision, and masked content. Administrator actions are audited as well, and logs can be exported as CSV.
How to use Agents connect to InterLock instead of directly to the data store. InterLock supports the protocols agents already use: Model Context Protocol (MCP), the Postgres wire protocol, and HTTP. Onboarding only requires changing the connection string, with no code changes. Agents keep their tools and connect using an InterLock key. Claude Code, OpenAI, and Gemini have been tested end to end, and any agent that supports MCP can connect. Sources enabled by default include OpenAI Codex and API, psql, and asyncpg; more connectors can be enabled.
Use cases Suitable for organizations that need to let AI agents access production databases, files, and APIs while requiring role- and policy-based authorization, masking of sensitive fields, approval for high-risk writes, and complete audit logs. It can be self-hosted and deployed within your own environment.
Limitations and status notes The officialprovides a feature status page that clarifies the status and evidence for each capability. The feature statuses listed include: governance pipeline, PostgreSQL proxy, MySQL and MariaDB, read-only enterprise connectors, deep PII scanner, cache invalidation, discovery ranking, Slack approval notifications, OpenTelemetry export, alert notifications, automatic classification. The official statement says that if something is not yet ready, the status page will clearly say so. InterLock is open source under the Apache 2.0 license and can be run yourself from GitHub, or you can contact the official team to deploy it on production data.
Other information The official team also mentions other infrastructure for production AI systems: correlating changes in evaluation scores with the dataset or pipeline changes that caused them, including contamination checks and dataset lineage; and distributed tracing of agent runs, recording each step, tool call, and decision so that failed runs can be reconstructed and understood.
