Route tool and API calls through AgentSafe. Choose where the gateway and authority run, then use network and identity controls to make that route the required path.
A hosted authority works with a gateway in your own network. Choose a managed gateway when you also want Decionis to operate the request relay.
On premises or private cloud
Operate the gateway beside your APIs on a host, in Docker or in your Kubernetes cluster. Decionis supplies the decision service.
Data boundary
The full request follows your local relay path. Intent, context and configured JSON fields reach the hosted authority.
Your approved network
Connect your gateway to a separately provisioned, compatible Decionis authority inside your approved environment.
Data boundary
Relay and policy data can stay within that environment. Authority installation, licensing and service connectivity are separate.
Managed cloud
Use an assigned tenant gateway to observe policy on calls to an API you control. Decionis operates the relay.
Data boundary
The full request, including upstream credentials, traverses the cloud relay. A public HTTPS API and operator onboarding are required.
On-premises placement alone does not make the flow offline. Review what the authority receives, who holds credentials and which approval services the deployment needs.
The platform controls who can connect. Decionis decides whether the exact action may proceed. AgentSafe enforces that decision at dispatch.
Agent tool
Calls the configured gateway URL
TLS ingress or mesh
Admits the workload identity
AgentSafe
Binds the request and claims before dispatch
Protected API
Performs the action and owns its outcome
Decionis authority ↔ AgentSafe
The authority evaluates policy and supplies bound grants. AgentSafe records the decision, claim and execution evidence.
When the tool exposes a base-URL setting, this is a configuration change. Apply it to the client that performs the action; changing a model endpoint does not capture separate payment, CRM or infrastructure calls.
Run one gateway per protected upstream. Keep the original API as gateway.upstream and point the tool at the gateway's TLS URL.
Preserve the API method, path and business idempotency key. Configure redirects explicitly and test authentication that signs the host or URL.
When a base URL cannot change, place agentsafe intercept beside the workload and redirect supported outbound traffic in its network namespace.
Governing HTTPS requires an interception CA trusted by the workload. Configure governed hosts and unlisted destinations; observation alone does not enforce a decision.
The agent must not control the redirect rules or use the exempt interceptor identity. Handle other ports and UDP/QUIC separately; pinned certificates and provider mTLS need another integration.
The generic gateway relays caller credentials. For privileged credentials the agent must never hold, or verified proposer/operator roles, use the trusted executor. HTTP proxy settings do not turn the gateway into a CONNECT or raw database proxy.
Combine the gateway with controls at the agent and the upstream. Use the patterns that match your environment; review effective rules on the deployed workloads.
Pod network
Install the gateway Helm chart in front of the API. Allow the agent namespace to reach DNS and the gateway; admit only the gateway to the protected API.
Use an enforcing CNI and inspect all policies. NetworkPolicies add their permissions together; the chart alone does not close the direct path.
Workload identity
Route calls to the gateway, require strict mTLS and authorize the agent at the gateway. At the API, admit the gateway's service-account identity.
Apply rules to the destination workloads and keep network confinement. A mesh policy does not reroute calls or verify an AgentSafe principal header.
Security groups
Separate agent, TLS gateway and upstream security groups. Remove broad agent egress and allow only the required gateway, authority and API paths.
Inspect every group attached to the workload: their allow rules combine. Shared EKS node groups need additional pod-level enforcement.
Network security groups
Associate NSGs with the intended NICs or subnets. Allow gateway, resolver and authority traffic as needed, followed by explicit denies for other paths.
Override default VNet access as well as Internet access. An Internet-only deny leaves internal bypass paths open; AKS also needs pod-level controls.
DECIONIS_API_KEY_FILE./.well-known/agentsafe-upstream.AgentSafe-Tenant-Key from trusted configuration. Keep the upstream credential separate.Policy lives in the authority. AgentSafe uses documented runtime or Helm configuration; it does not load a local policy file or a multi-upstream proxy map. A forwarded identity header remains an unverified claim unless the surrounding trust boundary establishes it.
Test from the real agent network and identity against an approved test API. Correlate gateway evidence with API receipts so a response code is never the only proof.
A valid decision and claim produce exactly one test effect at the API.
BLOCK, an unresolved ESCALATE and an authority outage under fail closed produce zero effects.
Direct calls, alternate endpoints and spoofed identities fail at the intended platform or identity control.
A timeout may be a DNS error or dead service. A 401 or 403 can come from an application that is still directly reachable. Require a working gateway-path control probe and evidence from the control that rejected bypass. During rollback, halt the workflow or restore its approved gateway configuration.
Implementation reviewed 6 October 2026. Guides link to reviewed source 2190cbe. Verify the capabilities and digest of the build you deploy.