The gap
One prompt injection, leaked key or runaway loop turns an assistant into an incident. Security reviews block launches. Auditors have nothing to inspect.
Nothing in the existing stack closes it. Identity providers register agents but never see their actions. Secrets managers hand the credential to the workload, so a compromised agent is a leaked secret. API gateways route and rate-limit without deciding anything.
The missing control plane
- Problem
- Agents need real access to do useful work, but nothing decides what they may do before they do it, and nothing proves what they did afterwards.
- Approach
- Agents never receive upstream credentials for gateway-mediated calls. They carry mandates — short-lived, signed grants of authority that can only shrink as work is delegated — and the gateway injects the real credential at call time.
- Result
- Every action is policy-approved before it runs, scoped to exactly what was delegated, revocable in one call, and recorded as tamper-evident evidence.
Gateway-mediated agents never hold upstream credentials. Least privilege is enforced, not requested.
What that gives a team
No standing secrets, and delegation that can only narrow — an agent can hand work to a sub-agent, never with more access than it holds itself. Default-deny policy evaluates every request before it reaches a resource, rather than flagging it in a log afterwards.
Revoke an agent and everything it started loses access at once, with no waiting for tokens to expire. Approval gates hold high-risk operations for an authenticated human. And the audit trail is append-only and tamper-evident, exportable for SOC 2, EU AI Act, NIST AI RMF and OWASP Agentic reviews.
Standards-native, not a rewrite
OAuth 2.0 token exchange (RFC 8693), OPA for policy, and MCP integrations. It fits the stack a team already runs instead of replacing it.
Assembling a proxy, a vault and a policy engine yourself gets you plumbing — not narrowing delegation, revocation propagation or a tamper-evident audit chain. And then you maintain it forever.
Designed in public
Every significant decision goes through a public proposal first. Slower, and the reason the project earned trust quickly — the reasoning is on the record, not just the result.
Contributors arrived with threat models I had not considered. Several of the sharpest edges in the design came from review, not from me.
Backing, earned by review
Nobody funded a deck. GitHub, Microsoft, Vercel and LF Decentralized Trust each reviewed the codebase and its security posture before committing.
- FoundedFirst commits on the gateway and policy core
- GitHub Secure Open Source Fund2026 cohort
- Microsoft for StartupsInfrastructure and guidance
- Vercel OSS ProgramSpring '26, 30 projects worldwide
- LFX MentorshipAccepted under LFDT