Agent Gateway — AI agents work, humans stay in control

Status note on the diagram. Two panels describe the target design and are not implemented yet: DPoP / RFC 9449 (sender-constrained, key-bound tokens) and Rich Authorization Requests / RFC 9396 (structured negotiation of fine-grained permissions at the token endpoint). Everything else shown — OIDC sign-in (Dex ships; Keycloak / Entra / Okta connect via OIDC_ISSUER_URL), delegations, RFC 8693 token exchange, short-lived scoped tokens, the PEP with approval + audit, SPIFFE/SPIRE workload identity — is live in the shipped images. Progress is tracked in the project's roadmap; Production deployments relying on either panel should ask the vendor before designing around them.

📑 Reading the docs: all links in this README are relative so the repository stays portable. If a documentation link lands on a 404 in your git server's front page, open README.md from the file view (…/src/branch/main/README.md) or browse the docs/ folder — the same relative paths resolve correctly there (and always will on GitHub).

🚧 Early preview — and your feedback sets the direction. Agent Gateway is a new project, published so you can pull it, run it and try it. Nothing here is frozen: what gets built next (agent-request flows, fine-grained delegations, per-tool MCP enforcement, DPoP/RAR…) is decided largely by what users tell us matters. If you run the demos, deploy it to your own stack, or just disagree with a design choice — write to [email protected] or open an issue on this repository; both go straight into the roadmap. Everything is free (including a non-expiring licence by email) — see Pricing.

Public demo repository. Pull the pre-built Docker images, run one compose stack, and see a complete authorization system for AI agents live: SSO delegations, short-lived agent credentials, spend caps with automatic approvals, single-use human approvals for high-risk actions, instant revocation, and an immutable audit trail.

💡 Fastest path: Quickstart → two minutes to a running stack. Then run the demos (scripted, graphical and policy playground).

The problem, in one paragraph

AI agents call tools that do real things — payments, deployments, data exports. "Trust me, the agent knows what it's doing" is not a control you can put in front of an auditor. Agent Gateway puts a policy enforcement point in front of every tool call:

1. A human delegates — after signing in with SSO (OIDC), you grant an agent exactly-scoped rights: these paths, these actions, this auto-approve cap, this expiry. Least privilege by construction; the delegation is cryptographically bound to your verified identity.
2. Agents work fast — low-risk actions execute automatically, no human in the loop. The 80% of agent traffic that is safe shouldn't wait.
3. High-risk actions stop — and reach a human — anything above the cap returns held for approval. Money hasn't moved. The gateway pushes an HMAC-signed approval.required webhook to your automation (Slack, Teams, n8n, PagerDuty — setup in docs/Notifications.md) and the console shows a pending badge, so the human is told, not polled. A named human approves (or denies) the exact action hash — single-use, replay-proof.
4. Revocation is instant — revoke the delegation and even an unexpired, correctly-signed agent token is refused at the gateway. Token validity ≠ authorization.
5. Everything is audited — allow, hold, deny, approval, approver — one immutable record per decision, ready for your SIEM.

Architecture

              OIDC (Okta / Entra / Keycloak / Dex)
 Human ──────────────► ┌─────────────────────────────┐
                       │  authz   (decision point)   │  delegations, policy,
                       │           :8081             │  user identity (OIDC)
                       ╰──────────┬──────────────────╯
                                  │ mint scoped token
                       ┌──────────▼──────────────────┐
 AI Agent ──token──►   │  gateway (enforcement point)│  every call: resolve
                       │           :8080             │  principal → policy →
                       ╰──────────┬──────────────────╯  approve? → audit
                                  │ forward only if allowed · held → approval.required webhook
                       ┌──────────▼──────────────────┐
                       │  your tools / internal APIs │
                       ╰─────────────────────────────┘

 Held for approval? The gateway pushes an HMAC-signed approval.required
 webhook to your automation (Slack / Teams / n8n / PagerDuty — setup in
 [docs/Notifications.md](docs/Notifications.md)); the console shows a
 pending badge + toast.

 Supporting services:
   tokensvc :8082   mints short-lived, delegation-scoped JWTs
   web      :8083   admin UI: delegations, approvals, audit + guided demo
   postgres :5432   durable store (delegations, approvals, audit)
   redis    :6379   instant token revocation + decision cache

Deep dive: docs/Architecture.md.

What this repo contains

Quickstart

Requirements: Docker Engine 24+, docker compose, curl, jq optional.

cd demo
docker compose up -d          # 7 containers, first pull takes a minute
./demo.sh                     # scripted end-to-end walkthrough

Then open:

The bundled development SSO has two fixture human accounts ([email protected], [email protected]) — they exist only in the demo IdP so logins work with no setup. In production you point OIDC_ISSUER_URL at your own enterprise IdP; your real users sign in with corporate credentials and the console instead shows "Signed in as · verified ✓" bound to the verified subject.

Everything runs from published images on Docker Hub (stevef1uk/agent-gateway-{authz,gateway,tokensvc,web}) — no source, no build. The included demo/keys/ are development fixtures matching the keys baked into those images; regenerate through the vendor for your own customers (Security-and-Licensing.md).

Demo 1 — scripted

cd demo && docker compose up -d
./demo.sh

See it walk the entire story live, step by step — SSO sign-in → delegation → agent token → €150 order auto-allowed (HTTP 200) → €250 order held (HTTP 202 + approval id) → you approve → order executes → revoke → next agent call denied (HTTP 403) with the token still valid on the wire.

Demo 2 — graphical

Open http://localhost:8083/demo.html on the same stack.

Nine interactive steps with animated request flows, a live spend-cap meter, health pills for every service and a live audit feed. Sign-in is one click (the IdP is relayed by the web tier — no /etc/hosts or extra setup on your machine) and all calls are real — nothing simulated. This is the demo to run on screen in a meeting.

Demo 3 — the OPA policy playground

Bring the stack up with the policy engine switched on:

cd demo
docker compose -f docker-compose.yml -f docker-compose.opa.yml up -d

Then open http://localhost:8083/policy.html. It shows the live Rego policy the authorization service is enforcing, lets you edit and apply it, and runs decision probes against the running engine — so you watch the hot reload take effect in seconds. Apply compiles your edit first, so an edit that does not compile is called out with the exact compiler error instead of appearing to do nothing; breaking the policy on purpose is refused and the previous policy keeps serving; Restore initial policy puts the committed version back, and Reload from file re-reads it after a host-side git restore (the page also refreshes itself when the file changes on disk). Full story: docs/Policy-and-OPA.md and docs/Demos.md.

URLs & endpoints (demo stack)

Using it for real

When you are done playing: docs/Deployment-Guide.md covers production operation of the same images — Postgres/Redis HA, Kubernetes, any OIDC IdP, SPIFFE/workload identity (mTLS), licence lifecycle, upgrade procedures and a troubleshooting reference.

Pricing

The product is free — including a non-expiring licence token by email. What is paid is the author's time and commercial terms:

Support is email at every tier, best-effort — no SLA at this stage. Every tier runs under the same commercial licence (AS-IS, no fitness warranty, liability capped — see docs/Commercial-Licence.md). Details and rationale: docs/Pricing.md.

License

Documentation and demo assets in this repository: MIT (see LICENSE). The software itself is distributed as pre-built Docker images under a commercial licence from the vendor — terms, warranty disclaimer and liability limits at docs/Commercial-Licence.md. In brief: the software is provided AS IS, with all faults, without warranty of fitness for any particular purpose; you evaluate it before production use; liability is capped at fees paid in the preceding 12 months (nil on free tiers); and every consequential action an agent takes under a delegation remains your organisation's responsibility.