AI Gateway
Every model call, tool call, and agent action passes one gateway inside your deployment. It labels the data, scrubs what must not leave, and picks the model your policy allows. Then it checks who is asking and writes it all down.
One request through the gateway, sample data
The question reads the payroll table.
Two names and an account number masked.
Private data, so the private model on your servers answers.
Reporting agent, managed by a named person.
Data, model, agent, and manager recorded.
What goes in
Every question sent to an AI model and every tool an agent calls through MCP (Model Context Protocol, the standard way agents reach other systems) passes one gateway inside your deployment, so one set of rules covers them all.
Label a database, table, or folder and choose which models may see it. Private data is answered only by the private model on your own hardware, and everything else can use leading cloud models.
Names, email addresses, account numbers, and other personal or sensitive data are found and masked before a prompt reaches a model. Detection runs on Presidio, Microsoft's open-source library for finding personal data, inside your deployment.
Open-weight models run on your own hardware and are tuned to your business. No question or answer goes to an outside AI provider.
The gateway sends traffic out only to the models, tools, and addresses on your allowlist. Anything else is blocked and logged.
Where your policy allows a cloud model, it runs on zero data retention terms, so the provider keeps no copy of the question or the answer.
Who is asking
Each agent signs in as its own identity with its own access, tied to a named person in your directory who answers for it. Its access is granted and reviewed like any person's account.
Content a person cannot open is filtered out before the model sees it, so it never reaches an answer, a citation, or a summary.
Every agent has an allowlist of MCP tools. Tools are read-only by default and writes are staged for a person to approve. Instructions hidden in a document or a web page cannot add a tool or skip an approval.
Revoke an agent identity and the gateway refuses its next model or tool call, even in the middle of a task.
Set how much each agent and each person may spend on AI models and how often they may call them. The gateway enforces both.
API keys, database passwords, and tokens are read from your own secrets vault when a call needs them. Agents and models never see them.
What comes back and what is kept
Every answer is scanned before a person or an agent receives it, and personal data the reader may not see is masked there too.
Every question, query, document read, model call, and tool call is written to a chained log: which data went to which model, by which agent identity, for which person. It streams to your SIEM, the system your security team already watches.
Your data is never used to train AI models, on any deployment.
Inside your deployment. On your own servers or air-gapped it runs beside the rest of Go Fig, so no prompt, answer, or log leaves your network to be checked.
The private models on your own hardware, and leading cloud models on zero data retention terms wherever your data policy allows them.
Each agent calls only the tools on its allowlist, read-only unless you allow more, and every write waits for a person to approve it. You can revoke its identity at once.
Yes. The audit log streams to your SIEM as it is written, and no entry can be changed without the change showing.
A solutions engineer walks through your data rules, your models, and your agents, and how the gateway would govern them. It takes 30 minutes.