An AI control layer cast in glass: watch personal data become tokens mid-flight

Client: GrN.dk — demo shelf (demo.grn.dk)
Sector: AI governance / data protection
Period: September 2026

demo.grn.dk/kontrollag

At a glance

Kontrollaget (“the control layer”) makes invisible AI infrastructure visible. It is a three-act demo for Danish organisations, in Danish and English: write a prompt containing personal data and watch it fly as tokens through a glass pipeline — PII scanner, policy gate, model router — with every step writing itself into an audit log; relive a US provider’s shutdown day with and without a control layer in place; then try to beat the anonymiser yourself in a live redaction playground.

Act 1: your prompt flies as tokens through a three.js glass pipeline — PII caught and tokenised mid-flight, audit log writing itself

Act 2: a US provider shutdown, lived twice — locked in, then rerouted mid-conversation to an EU model

Act 3: a live redaction playground — try to beat the anonymiser, typed or with Danish Whisper dictation

The challenge

A control layer between an organisation and its AI providers is plumbing: when it works, there is nothing to see, which makes it close to impossible to sell or to explain to a board. The claims behind it — personal data is tokenised before it leaves the house, no lock-in to one model provider, every step auditable — are exactly the kind that sound like slideware until someone shows the mechanism. The demo’s job is to show the mechanism.

The solution

Act one casts the pipeline in glass: a three.js scene where your actual prompt — fictional presets or your own words — flies as tokens through scanning, tokenisation, policy gate and model routing, personal data glowing red until it is swapped for tokens, and the audit log filling in step by step. Act two replays a concrete failure day: a US model provider shuts down, and you live the morning twice — once locked to that provider, once behind a router that fails over to an EU model mid-conversation.

Act three hands over the controls: a live playground where you try to smuggle personal data past the redactor — typed, or dictated in Danish through our own Whisper server, transcribed in one pass and never stored. Everything else runs locally in the browser on fictional data.

The results

The demo turns an infrastructure pitch into three things a viewer does rather than reads: watch the pipeline, survive the outage, fight the redactor. Being playable in Danish — dictation included — matters for exactly the audience a Danish control layer is for.

It shipped on the demo shelf as static files behind the same deploy loop as the rest, and it hands the governance conversation a URL instead of a whitepaper.