Gateway authority enforcement demonstration

Agents reason anywhere. Gamut governs how they act.

Gamut Gateway is the zero-trust enforcement point between agent reasoning and real-world action. Choose a scenario to see Gateway permit an action under bounded delegated authority, require a real-time human decision, or block it.

Choose a scenario

1. Select one of the three agent actions below.

What should Gateway do before this agent acts?

Each scenario proposes a different action. Gateway evaluates the action and selects the authority route required by policy.

Proposed action

Production checkpoint rollback

Awaiting evaluation

An AI operations agent wants to restore a synthetic production checkpoint. The action is consequential, so intent alone is not authority.

Agent: Before AI Acts Demo Agent
Action: execute
Tool: checkpoint.rollback
Target: demo://synthetic-production/baseline-v1
Data: internal synthetic
Environment: simulation

Selected scenario

Scenario 2: Roll back a production checkpointGateway must hold this consequential action for an eligible human decision.

Gamut Gateway

Runtime policy evaluation

Evaluating

Gateway applies transport, identity, policy, assurance and execution-integrity controls. A missing, stale, ambiguous or mismatched security input fails closed.

Request trust boundary

Service authenticationHMAC-SHA256 binds method, path, service, tenant, timestamp, nonce and request-body hash; signatures are compared in constant time.Queued

Freshness and replay defenceTimestamp must fall inside the permitted window and the service nonce must be unused.Queued

Schema and input boundsRequest identifiers, action context and tool input are type-checked, bounded, depth-limited and sanitised.Queued

Tenant and execution contextTenant, workspace, requester, agent, connection and session context are explicit and never inferred as wildcards.Queued

Signed runtime identityAudience, expiry, run, backend, delegation, intent and governance bindings must match the request.Queued

Governance and least privilege

Agent registration and lifecycleThe agent is registered, active and linked to named human and security owners.Queued

ATF maturity boundaryThe proposed action is checked against the agent's current autonomy and maturity level.Queued

Tool capability and audit loggingThe tool is registered for this agent, the action is within capability scope and logging is mandatory.Queued

Runtime Access PolicyA versioned policy must cover the exact adapter, target, resource, action, data class and environment; explicit deny wins.Queued

Data, risk and response readinessClassification, applicable data-flow evidence, linked risks and findings, incident readiness and red-team evidence are evaluated.Queued

Authority and execution integrity

Exact intent and payloadTool, action, resource, purpose, data class, environment, payload hash and target-state precondition are cryptographically bound.Queued

Dependency and state freshnessExecution dependencies and target state are hashed; missing, future-dated or stale snapshots are rejected.Queued

Authority routeGateway selects the valid authority path for the exact action. A route never overrides a hard blocker.Queued

Gateway decision

REQUIRE APPROVAL This request is outside pre-delegated authority and matches a policy requiring real-time human approval. The action remains held until an eligible decision is bound to this exact request.

Gamut AUTHORISE

Real-time authority required

Held by Gateway

What happens if you approve?

Gateway issues a short-lived, single-use warrant for this exact synthetic payload. Any material change requires a new decision.

Mandatory human approvalPassword and MFA assurance · eligible independent approver · decision justification · audit receipt

Authority evidence

Decision recorded

Recorded

Security properties demonstrated Tenant and workspace scope · agent, tool, action, target, intent and payload binding · expiry · nonce · single-use enforcement · immutable event trail

What this proves

Gateway applies authority before action.

The outcome follows the exact policy, identity, action and payload evaluated by Gateway.

Test the boundary

Try to reuse the authority incorrectly

Choose a boundary test or download the illustrative receipt containing the policy outcome, authority route, exact scope, expiry and audit events.

This browser-only experience demonstrates Gateway authority enforcement. It does not simulate the full Gamut platform or create a real approval, warrant or audit record.

Agentic CISO

Know the actor.

Records identity, ownership, purpose, maturity, tools and operating boundaries.

Gateway

Enforce before action.

Evaluates the exact proposed action and fails closed when authority is missing.

AUTHORISE

Delegate or decide in real time.

Supports bounded standing authority for eligible action classes and attributable human decisions when policy requires one. Authority is always scoped.

See the real platform

Bring your own agent. Keep control of what it can do.

Book a guided security architecture review to explore delegated-authority policies, live approval routing, blocking controls, integrations and evidence in the platform.

Book a security architecture review

Agents reason anywhere. Gamut governs how they act.

What should Gateway do before this agent acts?

Read service health

Roll back a production checkpoint

Export customer records

Production checkpoint rollback

Runtime policy evaluation

Request trust boundary

Governance and least privilege

Authority and execution integrity

Real-time authority required

What happens if you approve?

Decision recorded

Gateway applies authority before action.

Try to reuse the authority incorrectly

Know the actor.

Enforce before action.

Delegate or decide in real time.

Bring your own agent. Keep control of what it can do.