AI Agent Gateway

01

It acts as a person, never as a robot

A connection is issued to one member of staff and carries exactly their permissions. If a salesperson cannot read the margin on a shipment, neither can their agent — and when you narrow that person's role, the agent narrows with it in the same second. Every change it makes is signed with their name in the audit trail, so nothing is ever attributable to "the system".

02

One company, for the life of the token

A session is tied to one tenant and one company by the token itself, in the database, before a single message is read. There is no company field anywhere in the protocol, so nothing an agent sends can move it. A group running six companies can give an agent one of them and know it is one of them.

03

Reading is easy. Writing is deliberate.

Every tool that changes a record is off until three separate decisions switch it on: the company allows agents to write at all, this connection is not read-only, and that tool is enabled by name. Even then you can hold it — the agent gets a reference instead of a result, and somebody here reads a plain sentence describing what it would do and presses yes or no.

04

A tool it cannot use, it cannot see

The list an agent receives is already the list of what it may do. Anything beyond its person's permissions is not refused — it is never mentioned, because an agent that can see a tool will try it, and a log full of attempts is nobody's idea of a control. An administrator can also take a tool away from every agent even where permissions would allow it.

05

The screen that makes this signable

Every session, every call, its arguments, whether it was allowed and why not, how long it took and what came back — with passwords, tokens, account and card numbers masked before any of it is stored. A finance director does not agree to this because of a feature list; they agree to it because they can read what happened last Tuesday afternoon.

06

Nothing to install, and a limit on the damage

It is one address and one token, pasted into the client's configuration — no local server, no gateway of your own to run. And every connection carries its own ceiling: calls a minute, rows per answer, writes an hour, and an expiry date, so one careless loop is a throttled loop rather than an incident.