Gateway binary
A single static Go executable. Runs in Kubernetes, systemd, containers, or as a bare process. Stateless by itself and designed for horizontal replication.
Reference architecture
Architecture
What runs where, what talks to what, and which boundaries the gateway enforces. Use this page to scope a pilot, production deployment, or security review.
The gateway is a network control point
Agent runtimes connect to IntentGate instead of connecting directly to internal tools. The protocol on both sides stays the same; only the destination URL changes.
Agent runtimeLangChain, OpenAI Assistants, custom orchestrators, and other MCP or JSON-RPC clients.
IntentGate gatewayCapability, intent, policy, and budget checks before the tool call leaves the trust boundary.
Upstream tool serversSalesforce, databases, S3, internal APIs, payment systems, and other enterprise tools.
PostgresAudit, policy drafts, active pointer, revocations, approvals, elevations, and tenant configuration.
Six components. One control plane.
The runtime path stays compact. Optional operator and developer tools sit around the same gateway and API surface.
Policy bundle
Rego source held per draft in Postgres, compiled into embedded OPA and hot-reloaded on promotion. Customers may ship their own policy.
Postgres
The only persistent store. Schema migrations run at gateway startup. No message broker is required; multi-replica deployments add Redis for shared budget counters.
Console-Pro
An optional Next.js and React application for policy promotion, audit, approvals, elevations, and tenant switching. Every action also remains available over REST.
SDKs
Apache 2.0 Python and TypeScript libraries for tokens, capability attenuation, memory-provenance signing, and typed error parsing.
Extractor
A standalone Apache 2.0 FastAPI service that turns free-form user prompts into structured intent, backing the gateway’s intent check.
Request lifecycle
Five deterministic phases
Each tool call resolves to allow, deny, or escalate. If any authorization phase denies, the upstream tool server is never contacted.
Capability check
Validate signature, expiry, tenant claim, and tool scope, then check the JTI against the kill switch and revocation list.
−32010Intent check
Compare what the user authorized with the resolved verb, target, and scale of the attempted action.
−32011Policy check
Evaluate the resolved call against the active Rego bundle. Rules may deny or park the call for approval.
−32012Budget check
Debit per-window and per-tenant limits for cost, rows, and call count.
−32013Forward and audit
Send the authorized call upstream, capture the response, and append a hash-linked audit event.
ALLOW
Audit architecture
Every decision joins a tamper-evident chain
Allow, deny, escalate, elevation, policy promotion, and approval decisions are stored with a SHA-256 hash incorporating the prior event hash.
Changing or removing an earlier record breaks reconciliation. The gateway exposes verification and export endpoints without putting chain verification on the hot path.
Event 000184
Previous hash + decision + resolved call + policy hashhash: 9f2a…↓ linked by SHA-256
Event 000185
Allow · transfer_funds · policy 6b7e…hash: 11bc…↓ linked by SHA-256
Event 000186
Deny · bulk_export · budget exceededhash: a904…Authoritative verification
Returns the verified and skipped counts, and the first point of divergence.
GET /v1/admin/audit/verifyReturns the verified and skipped counts, and the first point of divergence.
Multi-tenancy is enforced at every layer
Policies, approvals, elevations, revocations, audit events, and budgets partition by tenant. Admin tokens cannot cross those boundaries.
Tenant A
Strict active policy, production budget, independent audit chain, and its own approval queue.
Tenant B
Dry-run policy evaluation while production authorization continues under the prior baseline.
Tenant C
Separate tokens, revocations, elevations, and operational configuration on the same deployment.
Deployment grows without changing the control model
The same gateway binary and authorization pipeline move from a one-replica pilot to regional production estates.
Single tenant
Designed for the first 30 days of evaluation.
- One gateway replica
- One Postgres instance
- Console on a sibling pod
- Single Kubernetes namespace
Single region
High availability for the standard enterprise deployment.
- Three gateway replicas
- Layer-4 load balancer
- Postgres primary and read replica
- Independent console deployment
Multi-region
Regional runtime and storage with cross-region token trust.
- Gateway and Postgres per region
- Regional signing keys
- Nearest-region serving
- Consolidated export at query time
Three trust boundaries matter
Each boundary limits what one compromised component can claim, see, or use.
Verified token claims only
The agent presents a signed capability token. Role, tenant, and scope are taken only from the verified payload, never from untrusted headers.
Credentials remain upstream
Service credentials live in Kubernetes Secrets, AWS Secrets Manager, Vault, or another gateway-side secret store. Agents never receive them.
Scoped database access
TLS, a constrained database role, tenant isolation, and audit hash chaining make unauthorized mutation detectable.
What the gateway deliberately does not do
IntentGate stays narrow so it can be evaluated, deployed, and trusted as an authorization control rather than another AI platform.
It is not an identity provider
Users continue to authenticate through Okta, Entra, Keycloak, Auth0, or the organization’s existing IdP.
It does not run inference
No model weights, LLM calls, token charges, or GPU footprint. The gateway runs on commodity CPU infrastructure.
It does not store conversations
Audit events record tool calls and decisions, not the prompts or model context that produced them.
It does not replace adjacent controls
Network egress, secrets management, IGA, PAM, and perimeter authentication remain in place. IntentGate authorizes every agent tool call.
Continue from the architecture
Move from system topology into the conceptual model, API surface, deployment guide, or enterprise audit integration.
Scope the control point before you scope the pilot
Map the agent runtimes, tool servers, identity flow, policy ownership, and evidence requirements in one architecture session.