Scoped identity
Bind each agent credential to a tenant, environment, and named agent identity.
Pilot specification · not generally available
Give agents narrow tools, not a master key.
The Agent Gateway is the governed access layer planned between AI agents and Launch Rail services. Its job is to make tenant scope, allowed actions, approvals, budgets, expiration, revocation, and audit evidence explicit.
Security gates before pilot release
These are acceptance requirements, not claims that a production gateway is already available.
Explicit allowlists
Default deny, then allow only reviewed tools and actions for the stated workflow.
Approval-required writes
Pause the first mutation workflow until an authorized person approves it.
Rate and cost budgets
Set customer-defined ceilings and fail closed when a budget is exhausted.
Authz checks
Evaluate the same tenant and action policies used by the application before execution.
Complete audit events
Record request, policy decision, approval, execution result, and correlation context.
Expiry by default
Require an expiration for every credential instead of issuing standing access.
Emergency revocation
Invalidate an agent policy immediately without waiting for normal expiry.
A policy that can be reviewed
Each policy combines scope, identity, tools, actions, approval mode, budgets, expiry, and revocation state. Secret values remain references; they do not belong in a policy manifest or diagnostic log.
Policy decision order
- 1Verify credential, tenant, environment, and expiration.
- 2Match the requested tool and action against the allowlist.
- 3Check rate, cost, and application authorization policies.
- 4Require an authorized approval for any permitted mutation.
- 5Execute, record the result, and attach a correlation ID.
agent-policy.yaml · illustrativeReview required
tenant: "<tenant-id>"
environment: "staging"
agent_identity: "support-copilot"
permitted_tools:
- identity.get_company
- audit.search_events
- identity.create_invitation
approval_mode:
reads: allow
mutations: required
budgets:
requests: "<customer-defined>"
cost: "<customer-defined>"
expires_at: "<required-timestamp>"
revocation_state: activeDefault-deny acceptance tests
Cross-tenant denial
A credential for one tenant cannot inspect or mutate another tenant.
Approval enforcement
A write never executes before the required authorized approval is attached.
Budget exhaustion
Requests fail closed when the configured rate or cost budget is reached.
Revocation
Emergency revocation blocks the next request and is itself auditable.
Authz decision
Application policy denial cannot be bypassed by a gateway allowlist.
Audit integrity
Request, policy, approval, execution, and outcome remain correlated.
Pilot one bounded agent workflow.
Start with read access and one approval-gated invitation flow. Expansion follows evidence, not enthusiasm.