Arguments
Canonicalized and redacted in-process. A digest and key list are recorded; values are not persisted.
Trust · Security model
Two planes, one direction of travel.
The enforcement plane runs inside your subscription and handles every request. The control plane publishes signed policy and receives nothing back. That split is the security model, and everything else follows from it.
Decision boundary: Gleis evaluates each tool call against the policy your organisation approved and the evidence collected at the gateway. It does not determine legal rights, certify compliance, or replace legal review.
What runs where
Your data never needs to leave your tenant.
Gateway, policy engine, classifierYour tenantTool calls, redacted before classification
Credential brokerYour Key VaultUpstream credentials, never returned to agents
Audit ledger, review queueYour PostgreSQLDecisions, evidence, digests; no raw arguments
Control planeGleis (Railway)Policy documents, approvals, entitlements; no request data
The gateway pulls signed policy bundles and verifies an Ed25519 signature against a pinned public key before evaluating locally. It pushes nothing to the control plane.
Guarantees we test for
Properties, not adjectives.
Each of these is a property the test suite asserts, including a scenario suite of adversarial fixtures. They are the claims worth holding us to in a security review.
- Identical inputs produce byte-identical decisions across processes and locales.
- A denied call cannot reach an upstream server by any path.
- Killing the policy engine mid-flight produces a denial and a ledger entry.
- No credential value appears in agent-visible output, ledger entries or telemetry.
- Every policy rule carries at least one compliance control tag.
- The author or proposer of a revision can never approve it.
Data handling
What is collected, and what deliberately is not.
Ledger entries
Decisions, evidence records, digests, versions and reason codes, in your database, append-only.
Telemetry
One OpenTelemetry span per call using GenAI semantic conventions. No arguments, responses or credentials become span data.
Control plane
Policy documents, approvals and entitlements only. Row-level security keys every query to one organisation.
Stated plainly
Where the limits are.
A security page that only lists strengths is not a security page.
The classifier is a probabilistic boundary
A confidently wrong classification is the expected failure mode, not an edge case. Tool profiles remove the model from the paths that matter most, and rules on low confidence let you route uncertainty to review or denial rather than trusting it.
Redaction is best-effort by nature
Key-name patterns, value patterns and length caps run before anything leaves the process. Pattern-based redaction cannot be proven exhaustive, which is why raw argument values are never persisted in the first place.
Gleis does not certify you
The crosswalk maps rule tags and reason codes to controls, and ships marked unreviewed until your own owner reviews it. It is a starting point for an assessment, not an attestation.
Need a security review?
Bring your architecture and vendor requirements into the pilot.
We will walk the two-plane deployment, the data path and the failure modes, and be explicit about which of your requirements the product does not meet today.