No enabled rule objects. The call executes with a brokered credential.
Policy infrastructure for agent tool calls
The track your agents run on.run on., are held to., cannot leave.
Gleis sits between an AI agent and its tools as an MCP gateway. Every tool call is classified into a typed action, evaluated by a pure policy engine against your approved rules, written to a hash-chained ledger, and only then executed with a credential the agent never sees. Everything that touches your data runs in your own tenant.
Deterministic decisions Fail closed on every path No credentials in the agent
05Policy effects
02Evaluation stages per call
00Credentials reaching the agent
100%Decisions written before execution
See how it works
Intercept. Classify. Decide. Execute.
One gateway in front of every MCP server your agents reach. Watch one approved policy decide across a support copilot, a release agent, a finance agent and an unknown third-party tool.
Tool-call decision stream · illustrative observation mode
StageInterceptEvery tool call passes through one gateway
09:41:02.118crm.mcp / contact.readConditionalREAD · CUSTOMER_PII · SUPPORT
Email and plan only · no payment fields
Synthetic traffic. No customer data, no arguments and no credentials appear in this view.
Operational, not rhetorical
Five effects your gateway can act on.
Every enabled rule whose condition matches contributes an effect, and the most severe one wins. There is no rule priority to reason about, so adding a rule can only make an action more governed.
Read the engine modelThe call proceeds under limits: field scope, redaction or a narrowed argument set.
An entitlement is required before this action is permitted for this tenant.
The call never reaches the upstream server, and the denial is recorded.
The call is held for a named approver in the review queue, with an SLA.
Why teams put a gateway here
The agent layer is where authority actually gets exercised.
Let agents act without handing them credentials
The broker issues a scoped, single-use, time-boxed token per allowed call and the gateway injects it. No upstream secret ever reaches the model context, the transcript or the logs.
No credential value in agent-visible outputMake a denial mean something
A denied call cannot reach an upstream server by any path. Timeouts, classifier outages and ledger failures all resolve to deny with a distinct reason code, not to a silent pass.
Fail-closed on every pathAnswer the audit question from a record
Each decision carries the policy revision, the digest, the evaluator and classifier versions, reason codes, matched rule ids and evidence ids, in an append-only hash-chained ledger you own.
Hash-chained ledger in your databaseKeep the data inside your tenant
The enforcement plane runs in your Azure subscription against your Postgres and your Key Vault. The control plane publishes signed policy bundles and receives no request data at all.
Two planes, one direction of travelTwo planes
Enforcement in your tenant. Policy published, never pulled.
The gateway, policy engine, classifier, credential broker and audit ledger run inside your Azure subscription, against your Postgres and your Key Vault. The control plane signs and publishes policy bundles; it never reaches into your environment and never receives request payloads.
Evidence, not assurances
The artifacts your governance programme keeps asking for.
Gleis does not certify you and does not give legal advice. It produces the signed policy revision, the deterministic decision and the append-only record that AI governance frameworks expect you to be able to show, and maps rule tags to the controls they evidence.
EU AI ActArt. 12 record-keeping · Art. 14 human oversight
Every consequential tool call leaves a ledger entry naming the policy revision, the evidence and the decision. The review queue is a real oversight point with separation of duties, not a checkbox.
ISO/IEC 42001AI management system controls
Policy revisions move DRAFT to PROPOSED to APPROVED to PUBLISHED, signed at publication, with the author or proposer barred from approving their own change.
NIST AI RMFGovern · Map · Measure · Manage
Shadow observation measures what your agents actually attempt before a single call is blocked, which turns the Manage step into a decision backed by your own traffic.
DORAICT risk and third-party oversight
Third-party MCP servers become a governed dependency: which tools are visible, which actions are permitted, and an append-only record of every call that reached them.
GDPR and data minimizationArt. 5 principles · Art. 32 security
Arguments are redacted before classification and never persisted raw. The control plane never receives request payloads, and the ledger holds digests and evidence rather than content.
HIPAA and CCPA/CPRAAccess control and disclosure records
Resource sensitivity is part of every decision, so rules can bar a purpose category from a sensitivity class outright and the crosswalk can answer which entries evidence that control.
A pilot you can run end to end
One agent, one tenant, four weeks.
No agent rewrite: the agent points at Gleis instead of the tool server, and nothing else in its configuration changes. Observation first, so the rules you enforce are the ones your own traffic showed you needed.
- Runs in your Azure subscription, against your data stores
- Tool profiles remove the classifier from hot paths
- Separation of duties on every published revision
- Ledger entries from the first call onward
- 01Scope one agent and its tools Week 0
Pick a single agent with real tool access. We inventory the MCP servers it reaches and write tool profiles for the calls that do not need a classifier at all.
- 02Deploy the gateway in your tenant Week 1
The gateway, engine, broker and ledger run in your Azure subscription against your own Postgres and Key Vault. The control plane only publishes signed policy bundles to it.
- 03Observe before you enforce Weeks 2-4
Run in observation and watch what your agents actually attempt: action types, sensitivities and purposes, with every decision already in the ledger.
- 04Approve rules and turn on enforcement Week 4+
Authors propose, a different person approves, publication signs the bundle. Enforcement starts with the categories your own traffic showed you.
mcp-config.json
# The agent points at Gleis instead of the tool server.
# Nothing else in the agent changes.
{
"mcpServers": {
"github": {
"command": "gleis-gateway",
"args": ["--upstream", "github", "--tenant", "acme"],
"env": { "GLEIS_BUNDLE_URL": "https://control.gleis.example/api/v1/bundles/acme/current" }
}
}
}
# The gateway pulls the signed bundle, verifies the Ed25519 signature against a
# pinned public key and evaluates locally. It pushes nothing back.Key resources
Catch up on agent governance.
Field note
The tool call is the control point
Agents do not cause harm by thinking. They cause it by calling something. Govern the call, not the conversation.
Read more Practitioner guideFail closed by construction
Availability and containment are in tension. Most agent stacks resolve it in the wrong direction, quietly.
Read more Control mapAudit trails for autonomous agents
What a decision record needs to contain to still be worth something a year from now.
Read moreFAQs
Quick answers about Gleis.
Straight answers, including the ones about what the product does not do.
See all questionsGleis is an MCP gateway. Your agent points at Gleis instead of its tool servers. Every tools/call is intercepted and redacted, classified into a typed action, evaluated by a pure policy engine against the revision your organisation approved, written to a hash-chained ledger, and only then executed with a scoped, single-use credential the agent never sees. The response is evaluated again before it re-enters agent context.
One line of MCP configuration: the agent points at the Gleis gateway instead of the upstream tool server. No SDK, no prompt changes, no rewrite. The gateway speaks MCP in both directions, and filters tools/list so the agent only discovers what your policy could ever allow.
No product makes an organization compliant. Gleis produces the artifacts those regimes expect for automated action: a signed, version-controlled policy, a deterministic decision per call, the evidence considered, the reason codes, and an append-only record in your own database. The crosswalk maps rule tags to controls and ships marked unreviewed until your own owner reviews it. Your GRC owner and counsel decide what it all means for your obligations.
For the enforcement path, nothing. The gateway pulls signed policy bundles and pushes nothing back. Argument values are redacted in-process and never persisted raw. The control plane holds policy documents, approvals and entitlements, and receives no request payloads at all.
Now recruiting design partners
Prove it on your own agents before you buy a platform.
Start with one agent, its real tools and a scoped tenant. You keep the ledger, the policy and the inventory of what your agents actually attempted, whichever way the pilot goes.
Decision boundary: Gleis evaluates each tool call against the policy your organisation approved and the evidence collected at the gateway. It does not determine legal rights, certify compliance, or replace legal review.