This is the detail behind the front page. Nothing here is roadmap filler: each item is either enforced in the request path or explicitly labelled as gated.
New to the product? Start with How it works.
The latest work tightens the governance loop: constraints that now enforce on every governed route, alert transitions that survive retries and restarts, token telemetry in the console, private endpoint spooling, and typed degradation. Newer foundations are published with their production gates visible.
Provider, model, tool, MCP-server, and input-size constraints are evaluated on every governed route — including the Anthropic-compatible /v1/messages path — after Unicode normalization, and a denied request is refused before any mutable side effect.
Fail closed before new AI or MCP work when durable evidence is unavailable, with health-aware recovery when the sink returns.
Export one consistent snapshot with chain verification, read-model checks, canonical bytes, and optional Ed25519 attestation.
Alert status changes carry durable idempotency keys with key-epoch admission and retirement, so a retried or replayed transition after a process restart cannot be applied twice.
Buffered and streaming OpenAI and Anthropic traffic records provider-reported prompt, completion, cached-input, and reasoning tokens, with explicit coverage reporting when a provider omits them.
Scan tool arguments before execution and tool results before they re-enter agent context; result findings remain alert-only.
Provision, deactivate, reactivate, or delete users through SCIM 2.0 and suspend every matching gateway principal in one action.
Endpoint operational events are held in a private, bounded, content-minimized spool with durable loss accounting and replay, so a disconnected endpoint does not silently drop its own history.
Shared-store failures in rate limiting and alert cooldowns fall back to a bounded local bucket, and AI-content detection has explicit block, pattern-only, and bypass modes — each reported rather than quietly absorbed.
Tenant-owned publisher and approval evidence binds exact readiness material, short-lived grants, and canonical hash-chained run receipts. The boundary remains fail closed until endpoint execution proof is complete.
The endpoint executor accepts only grant-derived capability profiles — never caller-supplied commands or paths — with filesystem, network, process, and environment modes defaulting to denied and resource ceilings enforced at the boundary. Kernel-level enforcement of those scopes is not yet wired: the profile is published to the child process rather than imposed by the operating system.
JSONL and database verification use fixed-size readers and per-row streams with a one-row lookahead, so peak memory no longer scales with chain length.
Store access sits behind engine-neutral traits, and MySQL now carries a first AI-review adapter beside PostgreSQL. MySQL is not yet a supported engine — the control-plane adapter still fails closed on the methods it has not implemented — and SQL Server is refused at startup by design.
Match declared MCP packages to a reviewed local OSV artifact with conservative handling for unknown versions.
Compare policy-declared access with observed behavior to expose unused privilege, denied attempts, and current-policy drift.
Retry once through a configured backup only when the same policy and sensitive-data approvals authorize it.
Everything the gateway does between a client and a provider — enforcement, evidence, cost, identity, and endpoints.
Allow/deny rules over providers, models, tools, and MCP servers — per team. Deny always wins; default-deny allow-lists.
Regulated deployments can refuse new AI and MCP work when the durable evidence sink is unhealthy, then recover automatically when the store is available again.
Cache-aware provider pricing, reasoning-token visibility, proactive budget warnings, and hard daily or monthly caps enforced inline.
Tool arguments are scanned before execution; untrusted tool results are scanned before they re-enter agent context, with content-free findings written to evidence.
Deterministic credential and identifier detection combines with an optional model tier for names, addresses, dates of birth, medical narratives, and other unstructured data.
Versioned, policy-gated templates with typed variables, static lint scores, and runtime quality metrics.
A pre-authorized backup can handle an unreachable, 5xx, or rate-limited primary only when the same policy and data-protection checks approve it.
One repeatable database snapshot is cross-checked against its read model, canonically serialized, and optionally signed with Ed25519 for offline verification.
Entra ID, Okta, Google Workspace, and ADFS identities map to policy; SCIM 2.0 deactivation suspends every principal key derived for that user.
An approved-app catalog enforced by an inline forward proxy and decision API, with a shadow-IT discovery feed for what is not yet catalogued.
Webhook notifications to Slack, Teams, or a generic endpoint on budget breaches, denial spikes, and sensitive-data blocks — with per-rule cooldowns.
An optional cap per key or user on top of the policy budget, plus token-bucket rate limits — over-limit requests get 429 before any upstream call.
Managed machines enroll once through the aops-agent binary and heartbeat on a scoped, one-time device credential — rotate or retire any endpoint from the operator UI without touching the team’s virtual key.
MCP servers and skills are cataloged and reviewed through a transactional approval workflow before they’re discoverable; a caller still only sees skills its own policy explicitly allows.
Each declared MCP implementation package can be checked against a reviewed local OSV artifact without live dependency resolution or runtime package installation.
Compare policy-declared models, providers, tools, and MCP servers with observed use to surface unused access, denied attempts, and policy drift.
The audit trail, budgets, and approvals persist to PostgreSQL you control — AWS RDS, Azure, Google Cloud SQL, on-prem, or Kubernetes — behind engine-neutral storage traits, with 129 versioned migrations across 38 components guarded against duplicate versions.
All 215 registered gateway operations are described in the OpenAPI contract, and a repository gate fails when a route and its documentation drift apart — so the interface you integrate against is the interface that ships.
Stage only pinned, signed, hash-verified endpoint artifacts; reject rollback before a fixed-purpose updater can act, and retain content-minimized lifecycle evidence.
Tenant-owned publisher, approval, readiness, and capability evidence can issue exact short-lived grants and canonical run receipts; native capability evaluation and production execution proof still gate activation.
Verify JSONL and database chains through fixed-size readers and row streams so peak memory stays bounded as evidence grows, without changing verification results.
Parity between registered routes and the OpenAPI contract is machine-gated.
Across 38 components, guarded against duplicate versions.
Newest delivered control-plane work, with its production gates visible.
Request access for deployment guidance, or run the open-source demo to see policy enforcement and verifiable evidence end to end.
By joining, you agree to our Privacy Policy and Terms.