Agent Security
Every agent known, verified and governed.
Registries track every agent, tool and model. Agents are verified alongside their users. Policies protect sensitive data and keep agent behavior within guidelines throughout the workflow.
Agent authorization
01 · Identity
Human + agent
Verified together
02 · Policy
Policy check
Identity, data and tool permissions
Access evaluated
03 · Action
Tool action
Permitted in this example
Decision recorded
Registered context
- Agents
- Tools
- Models
How it works
Authenticate, authorize and record every agent interaction.
Identify the agent and the user it acts for. Decide what each exchange allows. Adjust access to the agent’s current trust level. Record every decision.
AI Gateway
Identity · permissions · enforcement
01 / Agent interaction
Agent registry
Human / caller
Initiates request
Agent request auth
Verify identityAgent guardrails
Evaluate accessAgent
Acts within policy
02 / Agent-initiated requests
Model request
Model registry
Tool request
Tool registry
Authorization outcomes and supporting evidence for review
Agent, tool and model registries
Agents, tools and models register with verifiable credentials, and governed tools connect to any MCP-compatible framework.
Message-level policies
Policies apply to every exchange between people, agents, models and tools, protecting sensitive data and enforcing behavioral guidelines.
Query-level enforcement
Masking, row filters and hard denies compile into the backend query, so no execution path can bypass them.
Dynamic trust scoring
Scan recency, attestation and behavior produce a score that tightens an agent’s access as its posture declines.
Dual-principal authorization
Access is the intersection of agent and user permissions, and both identities are recorded on every audit event.
Audit and cryptographic receipts
Every allow, modify or deny produces a tamper-evident record with a verifiable receipt hash, exportable for audit.
What you get
Agents you can trust in production.
Agents at full capability.
Verified identity and policy on every exchange let teams deploy agents without stripping features to pass review.
A record of what was stopped.
Every blocked, masked or scoped action is logged with its reason, so teams can explain what an agent wasn’t allowed to do.
No credentials in agents.
The gateway holds every connector credential, removing a whole class of exfiltration and impersonation risk.
Enforcement outside the model.
Policies apply server-side to every message and query, so no prompt can talk an agent past them.
Fast integration.
Any MCP-compatible agent connects through one endpoint, so governed tools need only a connector configuration.
Audit-ready evidence.
Every decision produces a tamper-evident record that auditors can verify directly, with no log stitching.
Enforcement outside the model
User prompt
Show me a list of customer names and emails.
No credentials in agents
A record of what was stopped
Audit record
- principal
- John
- agent
- Sales
- action
- HR tool use
- decision
- Denied
- reason
- Unauthorized
- receipt
- 9f3a…c21e
Fast integration
Agent registry provides identity context for governed connections.
Access decided by identity, trust and data.
Dual-principal delegation
Access is the intersection of agent and user permissions, so every action is attributed to both the agent and the person directing it.
Trust that tracks posture
Access tightens automatically when a scan ages out or an attestation fails, which static role-based access can’t handle.
One policy with the data layer
Field-level classifications from Data Protection apply directly to agent traffic, with no separate governance to maintain.
Identities
Resources
AI Gateway
AI Policies
Use cases
Every agent an identity.
Every exchange a decision.
Access that tracks trust
An HR agent’s security scan expires, so its trust score drops and it’s limited to read-only with no bulk export. Nobody reconfigured anything.
Trust score
Posture declined
Scoped to agent and user
A support agent requests a record outside its rep’s segment. The agent can use the tool, but this call is denied and logged against both identities.
Delegated decision
get_customer(id: 8812) Record: APAC Logged: agent + user Receipt 4c7e…a19b
No sensitive data in prompts
A claims agent sends a case summary to an external model. Names and account numbers are protected in the message before it ever leaves.
Outbound message
Claims agent draft
Case summary: disputed card charge
- Customer
- John Smith
- Account
- 4417-3310
Sent to model
Case summary: disputed card charge
- Customer
- Qmzr Tbkwp
- Account
- 8821-0457