Platform
Agents do not cause harm by thinking. They cause it by calling something. Gleis governs the moment a call is made: what kind of action it is, whether your policy permits it, what credential it runs with, and what record it leaves behind.
Decision boundary: Gleis evaluates each tool call against the policy your organisation approved and the evidence collected at the gateway. It does not determine legal rights, certify compliance, or replace legal review.
Request lifecycle
Each step has a defined failure mode, and every failure mode resolves to a denial with a reason code.
The gateway receives tools/call over MCP. Arguments are canonicalized, credential-like values redacted, and a digest plus key list computed. Raw argument values are never persisted.
If your approved policy carries a profile for this server and tool declaring action type, resource sensitivity and purpose category, that profile is the classification and no model is called at all.
Otherwise the redacted shape goes to a pinned classifier as three constrained questions in one request, returning a label and calibrated probability per field, recorded as an evidence record naming the model id.
The engine evaluates the request, the evidence and your approved policy revision. Identical inputs produce byte-identical output, and the result is deep-frozen with every array sorted.
The decision, request shape and evidence are appended to the hash-chained ledger before anything reaches an upstream server. If the append fails, the call is denied.
On allow, the broker issues a scoped, single-use, time-boxed token, and the gateway injects it as a header or argument per the tool profile. The agent never receives it.
A timeout produces a denial with a distinct reason code and its own ledger entry. There is no proceed-if-unreachable path anywhere in the pipeline.
Deterministic detectors summarize the response—byte length, content types, pattern hits such as IBAN, EMAIL or SECRET_LIKE—and the engine runs again. A block means the content never enters agent context.
Policy engine
No I/O, no clock, no randomness, no locale-dependent operations. Evaluation time is an input, not an ambient fact, which is what makes a historical decision replayable rather than merely logged.
Every enabled rule whose condition matches contributes its effect, and the most severe contributed effect wins. There is no rule priority, so adding a rule can only make an action more governed or grant an explicit exception to something already denied by default.
Malformed input yields a denial with diagnostics. A malformed policy yields a denial. The engine has no path that raises an exception into your gateway process.
Classification is evidence, not authority. No model is asked at decision time whether an action is acceptable; it is asked only what kind of action this is, and your rules decide the rest.
Every rule carries at least one compliance control tag, and each decision aggregates the tags of matched rules plus the engine’s own invariant tags.
Fail-closed invariants
Tenant rules configure what is permitted. They cannot configure away the conditions under which Gleis refuses to decide at all.
Explicitly permitted by a matched rule.
Permitted under returned limits.
Requires a recorded entitlement.
Held for a named approver.
Blocked, recorded, never executed.
Audit ledger
The ledger lives in your own Postgres: advisory-locked appends, a database-level append-only trigger and chain verification. Every entry carries the policy revision id and digest, the evaluator and classifier versions, reason codes, matched rule ids and evidence ids.
Entries link to their predecessor, so a silent edit or deletion is detectable rather than plausible.
Digests, key lists and evidence records—never the argument values themselves, and never credentials.
If the ledger cannot record the decision, the upstream call does not happen. There is no unlogged action.
The crosswalk answers which ledger entries evidence a given control, rather than leaving that to a spreadsheet.
Credential broker
Upstream credentials stay in your Key Vault behind a managed identity and a scope allowlist. The gateway requests a token per permitted call and injects it itself, so no secret is ever present in a prompt, a transcript, a tool result or a span.
Issued for the specific call the policy allowed, not for the tool in general.
A replayed or leaked token is worthless outside the window it was minted for.
Credential material is removed from results and never becomes span or log data.
With NODE_ENV set to production, the in-memory broker and ledger used in tests are refused outright.
Next step
A pilot scopes a single agent and its tools, deploys the gateway in your tenant and runs in observation until the rules worth enforcing are obvious from your own traffic.