Controls you can show an auditor.

New tools, prompts, and resources from an upstream land in an approval inbox; nothing goes live until a person approves it. Approval records a SHA-256 hash of the complete definition, and an optional strict_hash re-checks that hash on every call. If an upstream changes a definition after approval, the change is held back and not served until someone approves the new version.

MCP resources can be thousands of short-lived URLs, so they are governed by URI patterns instead of one approval per URL. Each MCP server gets a list of allow and deny URI templates; deny wins, and an empty list serves nothing. Deployments that need more can enable strict mode, where every individual resource must be approved like a tool.

Everything is denied unless a rule allows it. Deny rules beat allow rules, an allow rule must require at least one scope, and the admin API refuses to create allow rules without scopes. Per-agent entries can only deny, never allow. A request's effective scopes are the token's scopes intersected with the agent's allowed_scopes, re-checked on every request.

Upstream credentials are stored once, encrypted at rest with AES-256-GCM, and never in agent configs. Each upstream authenticates with its own credential or via token exchange. Agent tokens are never forwarded. The two credential types are also kept apart in code: an agent token cannot even be sent to an admin route.

A provider endpoint points at a base URL and speaks the openai or anthropic API format. Model aliases and allowlists decide which models agents may call; alias-only mode rejects raw upstream model names; a pinned alias keeps pointing at the same model until an admin changes it, so a provider deprecation becomes a deliberate change instead of silent drift.

An endpoint can attach an approved system prompt to every request, placed before, after, or instead of what the agent sent. Replacing the agent's own system prompt is refused unless explicitly allowed. Tool allowlists restrict which functions a model may call, token budgets cap spend per agent per day, and an injection scanner can flag or block suspicious prompts without modifying them.

Built-in detectors cover emails, IPv4 addresses, credit cards (Luhn-checked), bearer tokens, API keys, JWTs, and the gateway's own agent tokens; custom rules add regex. Each rule applies to what the audit log stores, what is forwarded upstream, or both, and can redact, hash, remove, or exempt. Hashing is deterministic, so records stay correlatable without storing the raw value.

Agents authenticate with OIDC (OAuth-capable clients discover the gateway via RFC 9728 metadata and log in with PKCE against your IdP) or with personal access tokens for headless agents: 256-bit random, stored as a hash, revocable immediately, and limited to the scopes its agent is allowed. Operators sign in through SSO; a local bootstrap admin account is the fallback.

A web UI and the gwctl CLI cover the same tasks: syncing, approvals, policies, limits, exports, onboarding. Admin permissions come from roles in your IdP's tokens plus object ownership, and every denied admin action is logged with a reason. Prometheus metrics run on a separate port, OpenTelemetry tracing is optional, and configuration can be exported and imported between stages with secrets re-encrypted per host.