15 capabilities, one decision point.
- Capabilities
- 15
- Steps in the governed request path
- 11
- Model providers under one policy set
- 6
- Process, one database, one file to back up
- 1
See the estate
What AI costs the business, what it is being asked to do, and which of it anybody actually approved. These three answer the questions the product leads with, and none of them requires you to route a single agent through a gateway first.
AI spend and subscriptions
What you were billed and what you were metered, recorded as two numbers and never added into one.
A subscription that is on no invoice you give it
Read itApproved and unauthorised AI
Approved, prohibited, unknown — and unobserved kept separate from clean, because those two are not the same finding.
That a particular person's subscription is authorised
Read itAI conversation evidence
What the AI was asked and what it returned, redacted before it is stored and bounded before it is kept.
Every confidential business fact in free text
Read itKnow and authorise
The record of which agents exist and what each one may do. Nothing below this line means anything without it: a policy that fires on an agent nobody owns produces an alert nobody actions.
Agent registry
One record per agent, and it is the record the gateway enforces against.
An overdue review never suspends the agent itself
Read itAgent permissions
Deny by default, explicit deny wins, and delegation intersects — so an agent cannot borrow authority it was never granted.
Off by default; only enforce refuses anything
Read itDecide and enforce
The inline decision point. Every governed request is allowed, blocked, redacted or parked for a human before it leaves your network, and every policy can run in shadow mode first so you learn your false-positive rate before you start blocking real work.
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Injection scoring is nine fixed patterns, not a model
Read itHuman approvals
One human decision, bound to one exact payload, spendable once.
An approval takes effect only when the agent retries
Read itSpend controls
Hard USD ceilings, per-minute rate limits and a kill switch, all decided before the request leaves your network.
One billable egress: no retry, no failover
Read itRoute and prove
Six model providers behind one set of policies, and a searchable, hash-chained record of what each governed request did. The equivalence across providers is enforced by test, because a policy that fires on OpenAI but not on Gemini is worse than no policy.
Model routing
Six upstreams behind one set of policies, and a fallback chain that will not launder a refusal.
Nothing verifies a provider’s ZDR or training claim
Read itFlight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
The filter cannot group, count or correlate across traces
Read itAudit chain
Every administrative act hash-chained; seal it under a key held off the box, and anchor it with a signature your auditor can check alone.
Unkeyed, a rewrite that re-hashes everything verifies clean
Read itReach further than the model call
Tools, external effects, subscription seats and the traffic that never came through the gateway at all. This is where most agent risk actually sits, and where a gateway that only sees model calls stops being able to help.
MCP gateway
One endpoint in front of every upstream tool server, and the same evaluator deciding a tool call that decides a model call.
A tool call routed around it is not governed here
Read itEffect contracts
The action leaves once, and success is what a second pinned tool observed.
The downstream must enforce the idempotency key you send
Read itEndpoint seats
Policy enforced inside each vendor’s own administrator hook, decided offline against a signed bundle, because a hook that phones home fails open.
Preview. Not an inline gateway on an unmanaged device.
Read itShadow AI radar
Five evidence sources for AI activity that never touched the gateway, and a coverage model that refuses to call a dead feed a clean estate.
No billing, network or IAM access — you send the export
Read itAll 15 arrive with one environment variable.
From that moment the agent has an identity, a budget, a permission set, and a searchable record of each governed request.
OPENAI_BASE_URL="https://tokenobserve.company.com/v1" # was https://api.openai.com/v1
ANTHROPIC_BASE_URL="https://tokenobserve.company.com" # was https://api.anthropic.comA base-URL change is the normal case for the OpenAI-compatible, Anthropic and Gemini dialects. Whether your own SDK and version behave that way is the first thing to check, and the first thing a proof of concept settles.
- OpenAI
- Chat Completions, Responses and embeddings
- Anthropic
- Messages, including the x-api-key dialect
- Google Gemini
- Native Gemini ingress
- OpenRouter
- With caller-controlled route selectors refused before egress
- Amazon Bedrock
- For estates that will not egress to a model vendor directly
- Azure OpenAI
- Deployment-name routing under the same policies
- Your own endpoint
- Any OpenAI-compatible endpoint you host
The same policies, redaction, budgets and tracing apply identically whichever provider serves the request, and that equivalence is enforced by a test over every provider kind rather than asserted here.
See the request pathWhich of the 15 is the one you actually need?
Most estates need three or four of these and can defer the rest. Describe what your agents do and which of them worries you, and you will get a straight answer about where to start — including when the answer is that you do not need a control plane yet.
no form · no qualification step · no sales desk · the other three ways in