The policy layer for AI agents
Your agents' budget guard.
Your kill switch. Your audit trail.
Agent Auth Gateway sits between your agents and the world's side effects and enforces the policy you write — three lines of code, every decision logged.
- No surprise bills. Every tool call is checked against each agent's daily and monthly spend caps before it runs.
- No rogue actions. Allowlists and denylists decide what each agent may do — dangerous verbs wait for a human.
- No black-box denials. Deterministic, rule-based decisions: every allow, deny, and approval is logged with the rule that fired, fully human-auditable.
ILLUSTRATIVE · EXAMPLE VALUES
policy checks today · 1,204 · denied · 37
approvals cleared · 12 · kill switches · 0
The definition
Agent Auth Gateway is the authorization layer for always-on AI agents: every tool or API call passes through a drop-in proxy that enforces per-agent spend caps, action allowlists and denylists, human approval queues, and an instant kill switch — allow, deny, or require approval on every call, fully logged. Built by Ingenious AI.
01 / The problem
Agents don't ask permission.
Yours should.
An always-on agent is a loop with your credentials. It retries, it escalates, it finds creative ways to spend. The invoice arrives before the explanation. Agent Auth Gateway puts a vault-grade checkpoint between the agent's intent and the world's side effects — so "oops" becomes "denied, logged, and waiting for you".
Register the agent
Name it, set its owner, pick a risk tier — low, medium, high — and set daily + monthly spend caps.
Write its policy
Allowlist what it may do, denylist what it never may. High-risk tiers route verbs like delete or pay to a human.
Route calls through the vault
Three lines: ask the gateway before each tool call. It answers allow, deny, or require_approval.
Watch the trading desk
Burn forecasts, policy simulation, the approval checkpoint, anomaly lockdown — and the kill switch within reach.
02 / The chambers
Four chambers. Total authority.
One policy per agent. Evaluated in milliseconds on every call, logged forever.
Spend caps that actually stop spend
Daily and monthly budgets per agent, in dollars. The call that would breach a cap is denied before it runs — a runaway loop can never surprise you with a bill. Alerts fire at 80% so you see it coming.
Allowlists & denylists
Declare exactly which actions each agent may take. Unknown actions are denied outright — or paused for a human on Pro. The denylist is absolute.
Approvals, zero login friction
Risky or unlisted actions pause for a person. Approve from the dashboard, the API — or a signed email link that needs no login. Webhooks ping Slack the instant one lands.
A kill switch with teeth
One click — dashboard or API — disables an agent instantly. Every later proxy check returns deny, logged, until you re-enable it.
Pro vault · exclusive instruments
The vault doesn't just guard.
It forecasts.
Observability tools watch and alert. Gateways block at a static number. Nobody predicts the burn, dry-runs the policy, or freezes the agent the way a bank freezes a card — until now.
BURN FORECAST + AUTO-THROTTLE
"Days until this agent's monthly cap exhausts" — then the policy degrades gracefully before the wall hits.
WHAT-IF POLICY SIMULATOR
Replay 200 real calls against an edited policy. See exactly what flips before you commit the change.
ANOMALY STEP-UP LOCKDOWN
Spend spike or strange actions? The agent locks itself down — every call needs a human until you release it.
03 / Integration
Three lines. That's the migration.
Wrap the tool call you already make. Ask the vault first. The response tells your loop exactly what to do.
# PYTHON — your_agent.py import requests gate = requests.post( "https://agent-auth-gateway.onrender.com/v1/proxy", headers={"Authorization": "Bearer…" }, json={"agent_id": 7, "action": "send_email", "estimated_cost": 0.02}).json() if gate["decision"] == "allow": send_email(draft) elif gate["decision"] == "deny": log(gate["reason"]) else: wait_for_human(gate["approval_id"])
// JAVASCRIPT — agent.js const gate = await fetch( "https://agent-auth-gateway.onrender.com/v1/proxy", { method: "POST", headers: { "Authorization": "Bearer…" , "Content-Type": "application/json" }, body: JSON.stringify({ agent_id: 7, action: "send_email", estimated_cost: 0.02 }), }).then(r => r.json()); if (gate.decision === "allow") await sendEmail(draft); else if (gate.decision === "deny") log(gate.reason); else await waitForHuman(gate.approval_id);
Full reference on the docs page — decisions, webhooks, and the approval API.
04 / Pricing
Start free. Pay when agents earn it.
Free
Free
- 1 agent
- Daily + monthly spend caps
- Action denylist
- Evaluation log
Pro
Pro
Covers the policy engine, the evaluation log, approval infrastructure, and ongoing development + support.
- 10 agents
- Human approval queue
- Signed email approval links
- Webhook notifications
- Burn forecast + auto-throttle
- What-if policy simulator
Team
Team
- Unlimited agents
- 5 team seats
- CSV audit export
- Anomaly step-up lockdown
Just +$100/mo over Pro
Get Team — $149/mo05 / Try it live
Don't take our word for it.
Interactive
Policy playground
Paste an agent's action log — or pick a scenario — and watch our real policy engine decide allow, deny, or require_approval. No signup, nothing stored.
Open the playground →Comparison
AgentCost alternative
AgentCost's governance tier is Custom / Contact Sales. See the honest, verified side-by-side: what overlaps, where each wins, and what $49/mo self-serve buys you.
Read the comparison →06 / FAQ
Questions, answered directly
What is AI agent governance?
AI agent governance is the set of controls that keep autonomous agents inside their mandate: who can do what, how much they can spend, and when a human must approve. Agent Auth Gateway implements it as a proxy — every tool call is checked against caps, allowlists and risk tiers before it runs, and every decision is logged.
How does the proxy work?
Your agent sends each tool or API call to POST /v1/proxy with its agent id, the action name, and the estimated cost. The gateway evaluates your policy in milliseconds and returns allow, deny, or require_approval. It is a three-line change in your agent loop, and every evaluation is logged for audit.
What happens when an action needs approval?
The call is held and a pending item appears in your approval queue. You approve or deny from the dashboard, from the API, or from a signed email link that needs no login. On Pro, a webhook can ping Slack at the same moment. The agent polls or waits — nothing runs until a human decides.
How do spend caps work?
Each agent gets a daily and a monthly cap in dollars. Every allowed call's estimated cost counts toward both. The moment a call would breach a cap, the gateway denies it and logs the reason, so a runaway agent can never surprise you with a bill. Dashboard alerts also warn you at 80% of either cap.
What is the kill switch?
One click on the dashboard — or one API call — disables an agent instantly. Every later proxy check returns deny with the reason "kill switch engaged", so the agent cannot take any further action. Re-enable it the same way when the incident is over. Every toggle is logged and notified.
How much does it cost?
The Free plan is $0 forever: one agent, spend caps, and a denylist. Pro is $49/month for 10 agents, the human approval queue, webhook notifications, and anomaly alerts. Team is $149/month with unlimited agents, five seats, and CSV audit export. Buy a license key via WhatsApp or email and redeem it on the billing page.
Ready when your agents are
Give every agent a policy.
Keep every bill a surprise-free one.
Free plan · no credit card · governed in minutes.
Auth Gateway Pro — $49/mo: 10 agents, approval queue, burn forecast, policy simulator.