Agent Gateway · Early access
Give your AI agents safe hands.
The Agent Gateway lets AI agents propose IT actions through the Model Context Protocol (MCP). Every proposal stops at a human approval in Slack or Teams, executes as a deterministic runbook, and lands on a tamper-evident audit chain with the agent's identity attached.
AI agents propose. Your team approves. The chain proves it.
Agents are arriving faster than approval coverage.
Teams are wiring AI agents into IT workflows years ahead of the controls around them. In Gravitee's State of AI Agent Security 2026 survey, only 14.4% of agent fleets had full security and IT approval, while 81% of organizations were already past the planning stage.
Giving an agent write access to your identity stack is the same trust problem as giving it to a brand-new hire, minus the accountability. The answer is not to ban agents. It is to give them a sanctioned path: a gateway where anything they want done must be proposed, reviewed by a human, and recorded in a way you can verify later.
One gate, four steps
The agent proposes
Your agent connects over MCP and calls propose_action. The call never executes anything: it stages the same pending approval card a human request creates, targeting one of the runbooks the key is allowed to propose.
Approvers see the agent
The card lands in your IT admin channel with a provenance note naming the agent key and its stated reason. Your team always knows a proposal came from an agent before deciding.
A human decides
Approve or deny from Slack, Teams, or the dashboard. A denial changes nothing in your environment. There is no autonomous path around the gate.
The chain proves it
The proposal, the human decision, and the execution each land on the org's tamper-evident SHA-256 audit chain: which agent asked, who approved, what ran. Verify it any time.
What the gateway never does
Never executes on its own
Every tool an agent can call is propose-or-read. Execution happens only after a human approves.
Never holds your credentials
Agents authenticate to AscendCore with a scoped, revocable API key. They never receive credentials to Okta, Microsoft Entra ID, M365, or anything else in your stack.
Never improvises an action
Approved proposals execute as versioned, deterministic runbooks. Model output is a request, never an instruction set. The differentiator is the architecture, not the AI.
Never exceeds its allowlist
Each agent key can be restricted to specific runbooks. A key scoped to password resets cannot so much as propose an offboarding.
The same approval-first architecture that governs every human request on AscendCore governs agents. Read how the gate and the audit chain work on the Approval-First AI page.
A deliberately small surface
Agents get four tools. Every one of them proposes or reads. None of them executes.
list_runbooksDiscover which runbooks this key may propose, with the exact input shape each expects.
propose_actionStage a runbook proposal for human approval. Returns a run ID to poll. Never executes.
get_run_statusPoll a proposal for the human decision: pending, approved, or denied.
search_audit_eventsRead the org's hash-chained audit log. Requires the key to also carry the audit:read scope.
Works with MCP clients including Claude and Microsoft Copilot Studio, and with any custom agent that speaks MCP over streamable HTTP with a bearer key.
Bring your first agent aboard safely.
The Agent Gateway is in early access for design partners. Connect an agent in minutes, keep your team in charge of every action, and walk away with an audit chain you can verify.
