Everything between the SDK call and the provider.
Agent Access Manager is a modular gateway: authentication, authorization, routing, guardrails, metering, and evidence are separate subsystems on one request path. Here is what each of them does.
Eight subsystems, one request path.
Each capability is independently configurable and independently auditable. Turn on what your controls require and leave the rest dormant.
One OpenAI-compatible endpoint
Applications point at a single gateway URL. Chat completions, responses, messages, embeddings, and model listing are all served in the OpenAI shape, so existing SDKs work unchanged.
- OpenAI-compatible /v1/chat/completions, /v1/responses, /v1/messages, /v1/embeddings and /v1/models
- Faithful passthrough — unknown request parameters are captured and re-emitted upstream
- Translating adapters for Anthropic, Gemini, and Vertex AI so one format reaches any backend
- Multimodal content and streaming responses pass through end to end
- Per-deployment parameter filtering strips fields a given upstream rejects
Scoped virtual keys
Vendor master keys are registered once by an administrator and never leave the gateway. Everything else authenticates with a virtual key that carries its own governance scope.
- 256-bit keys, SHA-256 hashed at rest, with a non-secret hint for identification
- Every key belongs to an organization and optionally a team and project
- Issue, verify, and revoke without touching the underlying provider credential
- Per-scope key-count ceilings prevent uncontrolled key sprawl
- Provider credentials AES-256-GCM encrypted; the app refuses to start without a master key
Routing, load balancing, failover
A model alias maps to as many provider deployments as you like. The router picks a healthy candidate, and a failed attempt falls through to the next one rather than to the caller.
- Health-aware routing with a per-deployment circuit breaker and cooldown window
- Random load balancing across healthy candidates, cooled-down ones tried last
- Automatic fallback across vendors within a single request
- Transient-failure retries with exponential backoff and jitter, safe for streaming
- Cost-aware spillover: cap one vendor per deployment and let the alias serve from a cheaper backend
Runtime guardrails
Content checks run in both directions — on the request before it leaves your network, and on the response before it reaches the application. Policy is defined per organization, with nothing pre-seeded.
- Detector kinds: in-process regex with validators, or remote AI classifiers over HTTP
- Remote adapters for openai-chat guard models (Llama Guard, Granite, ShieldGemma) and Presidio span analysis
- Actions per category: allow, flag, redact, or block — with mask, hash, partial, or reversible token strategies
- Inline streaming redaction that holds a boundary-spanning match and stops the stream on a block
- Per-rule fail-open or fail-closed posture when a detector cannot finish scanning
- ReDoS-guarded pattern evaluation and a read-only dry-run screening endpoint
Budgets and rate limits
Quotas attach to a scope and are enforced across the whole chain — key, project, team, organization — so a limit set anywhere above a caller still binds it.
- Token and currency-cost caps with a soft warning threshold below the hard limit
- Reset periods of none, hourly, daily, weekly, or monthly with lazy window rollover
- Several budgets per scope: an all-models monthly cap alongside burst, per-model, and per-deployment caps
- Per-minute RPM and TPM limits via a sliding-window counter, returning 429 with Retry-After
- Valkey-backed counters for multi-instance deployments, in-JVM for single-host
- One organization base currency so spend aggregates with no FX conversion
Audit trail and usage analytics
Governance is event-driven through a durable transactional outbox, so every governed call and guardrail finding is recorded whether or not a downstream consumer is online.
- One audit trail covering model calls and guardrail findings, discriminated by category
- Per-call identity, provider, upstream model, requested alias, token usage, cost, and outcome
- Spend by model, spend over time, and request-density heatmaps by hour, day, week, or month
- Team- and project-scoped reads with no join, backed by a composite index
- Month-partitioned storage with opt-in retention that drops partitions past a configured age
SIEM, detections, and containment
An optional projection indexes normalized governance events into OpenSearch for security operations, with automated containment available even when the SIEM is switched off.
- ECS/OCSF-style event envelope indexed into daily OpenSearch indices
- Sigma rule support, detections, and behavioral analytics over the event stream
- SOAR containment with reversible quarantine and throttle actions; revocation stays manual
- ISM retention with hot → archive → delete, snapshotting to fs or any S3-compatible store
- Entirely optional — dormant unless explicitly enabled
Organizations, teams, and roles
Governance entities are first-class. Keys, budgets, and guardrail policies attach to an organization, team, or project, and members administer their own organization without platform-admin access.
- Nested role model — owner, admin, operator, user, guest — resolved fail-closed
- Money is a distinct capability: operators run the gateway, admins and owners control spend
- Delegated team leads curate their roster and sub-allocate project budgets
- Email invitations, membership management, and anti-escalation checks on every role change
- Guarded hard delete publishes a purge cascade so scoped data is genuinely erased
Two credential types, kept strictly apart.
Machines never hold a human credential and humans never hold a data-plane key. The separation is enforced by distinct security chains, not by convention.
Applications and agents authenticate on the data plane with a virtual key. The filter resolves the owning organization, team, and project so every downstream policy check has full scope context.
The admin plane accepts an HTTP Basic break-glass administrator, and — opt-in — validates OIDC bearer tokens as an OAuth2 resource server. The human session lives at your identity provider, never in the gateway.
Budget thresholds, guardrail blocks, and detection matches raise notifications through the notifications module, so a policy event reaches an owner rather than sitting in a table.
Every subsystem has a screen behind it.
Administration and investigation run from one dashboard inside your network. These are captures of a demonstration deployment carrying synthetic traffic.
Map your controls to a working architecture.
Bring your provider mix, agent estate, and compliance obligations. We will show you exactly which subsystems carry them and what a deployment looks like in your environment.
We typically respond within one business day.