How it works
One governed endpoint sits between any AI agent and the systems that run your business. Identity comes from your directory, writes stop for a human, and what happened is signed and stored in a database you own.
One endpoint. Your identity. Your systems.
Agents speak MCP to a single address. What they can see is decided per person and per agent; what they can do is decided by policy; what they did is written down and signed.
Microsoft Entra, Okta, Auth0, Keycloak — any OIDC provider. Groups map to scopes, so people are managed where they already are.
A gated write is parked, not executed. Approval unlocks a single-use grant bound to the exact arguments — approve $50k and $500k cannot follow.
Every outcome is signed and lands in your own database — Dataverse, Azure SQL, Snowflake. Query it, report on it, keep it as long as you like.
Single-tenant, in your cloud — one container, your network, your data. Nothing is routed through us, and no agent traffic leaves your boundary to reach a system inside it.
What happens on one call
An agent asks to update an opportunity. Here is every gate it passes, in the order it passes them — the order is part of the design, not an implementation detail.
The caller's token is validated against your identity provider. No token, no catalog.
The token names the app that obtained it. A registered agent gets a ceiling — never more than its human.
Scopes decide what is even visible. A tool the caller can't use is not in their list at all.
Per-user, per-system rate limits apply here — before anything downstream is created, looked up or emailed.
Writes park for a named approver. They decide in the console; the agent retries and it lands as the requester.
The outcome is signed and written to your ledger, with requester, approver and a hash of the exact arguments.
Every one of those exits is audited — the refusals as well as the successes. There is no path through the gateway that reaches a system without a record, and none that leaves without one.
For the technically minded
No new identity system, no credential vault, no agent-side trust. The gateway holds nothing that outlives the request.
requester [email protected] agent copilot-marvin attested approver [email protected] tool crm.opportunity.update args_hash 1f2e3d4c5b6a… outcome executed after human approval trust 100 / 100 signature Ed25519 · verify at /.well-known/signing-key
Each call exchanges the caller's own token for a backend token. The system of record applies its own permissions underneath — a user can only ever reach what they could already open.
Agent identity comes from the token's azp claim, asserted by your IdP. A self-reported name is recorded for the audit trail, but it never grants anything — and it never counts as being registered. Attestation is what satisfies a policy; nothing else does.
The gateway never executes on your behalf later. Approval unlocks a single-use grant bound to (tool, args-hash, requester) that the caller re-runs under a fresh token.
Agents that pick tools by schema get the whole catalog. Hosts with tighter context can ask for a compact surface instead — search, fetch one schema, invoke — over the same per-identity catalog. Discovery can never surface a tool authorization hides, and both routes run the identical gates.
Systems, users, agents and policy are YAML you can git-track and review. The console writes the same files.