Build a Governance-Aware AI Sandbox with Node.js

🚀 Technical Briefing:This tutorial is part of our deep-dive series on Agentic Workflows at[Gate of AI]. For the full technical breakdown, interactive code sandbox, and the native Arabic translation, visit the[original article here].

<span>Tutorial</span>
<span>Advanced</span>
<span>⏱ 120 min read</span>
<span>© Gate of AI 2026-07-30</span>

Learn how to build a governance-aware AI sandbox using Node.js and Express, complete with RBAC, middleware, and AI integration, leveraging the latest AI governance features.

In this tutorial, we will create a robust backend system using Node.js and Express, designed to enforce governance rules and manage AI services securely. The system will feature a modular monolithic architecture with middleware for token validation, RBAC (Role-Based Access Control), and project-level scoping. It will also integrate external AI services like OpenAI and Hugging Face to perform inference tasks.

The AI sandbox will serve as a controlled environment where developers can experiment with AI models while adhering to strict governance policies. This is particularly useful for organizations that need to ensure compliance and security in AI-driven applications, aligning with initiatives like Saudi Vision 2030.

We'll start by setting up the project environment. This involves installing Node.js, Express, and TypeScript, as well as configuring the necessary environment variables for API access.

npm install express@5.x typescript@5.4 better-sqlite3 dotenv

Next, create a .env

file to store API keys and other sensitive information securely. This file should not be committed to your version control system.

API_KEY_OPENAI=your_openai_api_key
API_KEY_HF=your_huggingface_api_key
DB_PATH=./database.sqlite

In this step, we will set up a basic Express server with TypeScript. This server will serve as the foundation of our AI sandbox.

import express, { Request, Response, NextFunction } from 'express';
import dotenv from 'dotenv';

dotenv.config();

const app = express();
const PORT = process.env.PORT || 3000;

app.use(express.json());

app.get('/', (req: Request, res: Response) => {
  res.send('Welcome to the AI Sandbox!');
});

app.listen(PORT, () => {
  console.log(Server is running on port ${PORT});
});

Here, we import necessary modules, configure environment variables, and set up an Express application. We define a basic route to test the server setup and start the server on the specified port.

Middleware plays a crucial role in enforcing governance rules. We will implement middleware for token validation and RBAC.

function tokenValidation(req: Request, res: Response, next: NextFunction) {
  const token = req.headers['authorization'];
  if (token === process.env.VALID_TOKEN) {
    next();
  } else {
    res.status(403).send('Forbidden');
  }
}

function rbacMiddleware(role: string) {
  return (req: Request, res: Response, next: NextFunction) => {
    const userRole = req.headers['x-user-role'];
    if (userRole === role) {
      next();
    } else {
      res.status(403).send('Access Denied');
    }
  };
}

app.use(tokenValidation);
app.use(rbacMiddleware('admin'));

The tokenValidation

middleware checks if the request contains a valid authorization token. The rbacMiddleware

function is a factory that returns middleware enforcing role-based access control for a specific role.

In this step, we will integrate AI services using OpenAI and Hugging Face APIs. This allows our sandbox to perform AI tasks such as text generation or sentiment analysis.

import { OpenAI } from 'openai';
import axios from 'axios';

const openai = new OpenAI(process.env.API_KEY_OPENAI);

app.post('/generate-text', async (req: Request, res: Response) => {
  try {
    const { prompt } = req.body;
    const response = await openai.chat.completions.create({
      model: 'gpt-4o',
      messages: [{ role: 'user', content: prompt }]
    });
    res.json(response.choices[0].message);
  } catch (error) {
    res.status(500).send('Error generating text');
  }
});

app.post('/analyze-sentiment', async (req: Request, res: Response) => {
  try {
    const { text } = req.body;
    const response = await axios.post('https://api-inference.huggingface.co/models/sentiment-analysis', { inputs: text }, {
      headers: { Authorization: Bearer ${process.env.API_KEY_HF} }
    });
    res.json(response.data);
  } catch (error) {
    res.status(500).send('Error analyzing sentiment');
  }
});

We initialize the OpenAI client and define endpoints for text generation and sentiment analysis. These endpoints use the respective APIs to process requests and return results.

⚠️ Common Mistake: Ensure that your API keys are correctly set in the environment variables and that your server has internet access to connect to external APIs.

To verify the implementation, use tools like Postman to send requests to the endpoints. Ensure that the middleware correctly enforces governance rules, and the AI services return expected results.

curl -X POST http://localhost:3000/generate-text \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_VALID_TOKEN" \
-d '{"prompt": "Hello AI"}'

curl -X POST http://localhost:3000/analyze-sentiment \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_VALID_TOKEN" \
-d '{"text": "I love programming!"}'