Gamut Gateway

Gamut Gateway is the policy decision and enforcement engine of the agentic stack. It is the ATF runtime: every agent action passes through Gateway, which evaluates it against the full governance context, decides, performs the call only if permitted, and records the decision either way.

What Gateway does

Gateway sits between agents and the models, tools and data they want to use. Nothing reaches a tool directly. For each requested action it assembles the governance context, agent register, Runtime Access Policies, org chart, tool permissions, approval gates, data flows, incident playbooks, red-team tests, linked risks and findings, and runs a sequence of controls before allowing anything.

The decision model

Gateway resolves every request to one of four runtime decisions:

Decision	Meaning
allow	All controls passed. The action proceeds, and is logged.
require_approval	A high-impact action with control gaps. A named human must approve first.
degrade	The action proceeds in a reduced, safer form.
block	The action is refused.

For high-risk or external actions that pass, the decision becomes allow and log with mandatory detailed audit logging. Where critical control failures coincide with an open critical finding, the decision escalates to block and open incident.

The controls Gateway evaluates

For each action, Gateway runs an ordered series of checks. Any of the first two short-circuit to an immediate block:

Agent registration. An unregistered agent is blocked at critical severity. No exceptions.
Lifecycle status. A suspended agent is blocked until formally reactivated.
Human owner is assigned.
Security owner is assigned.
ATF maturity level is assigned, and the action sits within that level’s boundary (see below).
Tool permission. The tool is registered for this agent in Agentic CISO, with audit logging enabled, and human approval required if it is a critical-risk tool.
Approval gate. External, financial or code-modification actions are covered by an active approval gate that matches the action type, tool, target system, data class and environment.
Runtime Access Policy. Material actions must have a matching active, least-privilege policy for the agent, adapter, governed connection, action, resource, data class, environment and any workflow or purpose boundary. Missing or non-matching coverage fails closed. Draft, pending, rejected, suspended, revoked and expired policies never permit execution.
Org escalation path. High-impact actions must map back to an org-chart reporting path so escalation and accountability are clear. The org chart does not grant permission and does not create inherited access.
Data movement. Customer or regulated data (PII, confidential, restricted) has a documented data-flow record.
Incident playbooks. High-risk agents have playbooks for prompt injection, unauthorised external action and rogue-agent scenarios.
Linked risks and findings. Open risks or findings tied to the agent are surfaced; open critical findings can escalate the decision.
Red-team validation. High-risk or external actions have at least one passed red-team test on record.

Each check contributes to a decision path and, on failure, a rule trigger, so every decision is fully explainable: which controls passed, which failed, what evidence is missing, and exactly what would change the decision.

Gateway also records a bounded policy trace. The trace shows the runtime-policy match, the org escalation path, the matched approval gate and the decision path without storing raw payloads or secrets. The Gateway Event Centre surfaces this evidence for operators.

Runtime Access Policy and org chart enforcement

The Access Matrix screen manages Runtime Access Policies. It is an enforcement control, not just documentation. For a material action, Gateway checks for an active policy covering the requested agent, adapter, governed connection, action, resource, data, environment, workflow and purpose. If no policy covers the exact request, Gateway blocks it and records the gap. A matching deny policy takes precedence over an allow policy.

The org chart has a different purpose. It proves reporting, escalation and accountability. Gateway uses it to build an escalation path for high-impact decisions, but it never uses the org chart to grant access, inherit permissions or override Runtime Access Policies, tool permissions or approval gates.

ATF-level action boundaries

Gateway enforces the agent’s ATF level as a hard ceiling on autonomy:

L1 Intern may only read, observe and report. Writes and external actions are blocked.
L2 Junior may take routine actions; every external or financial action requires an approval gate.
L3 Senior operates within guardrails; financial and high-risk external actions require approval.
L4 Principal has strategic autonomy; critical or top-secret data access still requires documented approval.

Why enforcement lives in one place

Concentrating enforcement in Gateway is what makes the zero-trust model work:

Credentials stay on Gateway. Model provider keys and connector credentials live only on the Gateway side, never with the agent. A compromised agent cannot leak keys it never held.
Policy is consistent. Every action is judged by the same engine, so governance does not depend on each agent behaving well.
Evidence is complete. Because every action flows through one point, the runtime evidence fed back to Agentic CISO is comprehensive.

Request-bound, short-lived authorisation

Gateway does not just return a verdict. It issues signed, time-bounded and request-bound authorisation. The authority is tied to the tenant, workspace, agent, request, governed connection and the exact active policy version. Only an allowed and fully satisfied request can receive executable authority.

Immediately before execution, Gateway confirms that the policy and surrounding governance state are still current. The action is refused if the policy has changed, expired, been suspended, revoked or replaced, or if the request no longer matches the authorised identity, action, resource, connection or context. A required approval is bound to the same request and cannot be reused for unrelated work.

Execution authority is short-lived and replay-resistant. Repeated delivery of the same request does not create duplicate side effects, and concurrent execution attempts cannot both consume the same authority. This closes the time-of-check to time-of-use gap between deciding and acting.

Connectors and approval gates

Tools are exposed to agents as governed connectors registered in Gateway, model gateways, retrieval, HTTP and webhook adapters, ticketing, notification, storage, CRM and more, each with its own action type, risk tier, payload limits and response handling. See the connector catalog. Sensitive or mutating actions can require explicit human approval; those approval gates are defined as governance in Agentic CISO and enforced here.

Fail-closed by default

If Gateway cannot reach a dependency, cannot verify a signature, or encounters an error mid decision, it fails closed: the action does not proceed. Safety never depends on a call succeeding.

The kill switch (break-glass)

When you need to stop everything, an administrator can activate the Gateway runtime kill switch from the admin console (Gateway Status, Disable Gateway Runtime). It requires gateway-configuration permission and a step-up re-authentication, and it is audited. While it is active:

Gateway blocks every agent action with a kill-switch decision, regardless of agent or policy.
Gamut itself fail-closes every dispatch path, so a new Claw task, a workflow dispatch and a scheduled run are all refused before they reach the runtime. Scheduled runs are skipped, not failed, so they resume automatically once the switch is cleared.

This is defence in depth: the halt does not depend on any single service. A separate Claw kill switch, set on the Claw execution service, stops the worker entirely. Reactivating the Gateway runtime is itself a privileged, audited action. To halt a single agent or a single step instead, use agent suspension or the Workflow Studio Stop button (see Agentic CISO).

Connector catalog: the governed tools Gateway can expose.
Runtime Access Policies: the exact authority Gateway matches and revalidates.
Gamut Claw: the execution layer that calls through Gateway.
Agentic CISO: where the policy Gateway enforces is defined.
ATF: the framework Gateway is the runtime for.