Operate · Guide 04

Gateway and enforcement

Put policy at the tool-call boundary so an agent checks enterprise authority before a consequential action executes.

7 min read

Pre-release documentation. This guide describes the current product design and evaluation build. Packaging, availability and commercial terms may change before release.

01

Advisory versus enforced

A prompt, skill or optional tool is advisory because the model may ignore it. An enforced integration places a mandatory hook or gateway on the only path to the protected tool.

Enforced: the check occurs before execution and the verdict is binding
Advisory: the agent is instructed to ask but can bypass the instruction
Deployment topology determines the real strength of the control

02

Decision shape

A gateway request supplies the actor, proposed capability, resource, purpose and relevant facts. Rulebook returns a structured verdict and the obligations needed to proceed.

request context
  -> Rulebook decision
     -> allow
     -> deny
     -> require approval
     -> transform with obligations
  -> protected tool executes only when authorized

03

Integration patterns

Native pre-tool hooks in agent SDKs
A gateway proxy that wraps an MCP or HTTP tool surface
Policy emission into a platform-native engine such as Cedar or Rego
Required checks in CI and release workflows

Executive briefing

Apply the architecture to one consequential workflow.

Bring one consequential agent workflow. We will map the governing policies and regulations, runtime gate, human authority and auditable evidence path with your team.

Request a briefing