Every AI request, decided by a signed policy.
PolicyGate sits in the request path: a signed policy decides every AI request, and every decision becomes signed evidence you can verify yourself.
Guest auditor: no password, read-only, 30 minutes. Runs against a live test installation with demo data.
- 01Request
An app calls a model through the gateway with its token.
- 02Policy
The signed policy bundle decides: tenant, model, region, scope, rate.
- 03Decision
Allowed, or denied with a reason such as model.not_allowed.
- 04Signed evidence
Every decision is signed into the tenant's hash chain.
- 05Verify offline
Anyone checks the signatures in the browser or offline.
Runtime enforcement
Every AI request passes the gateway, where the policy decides on tenant, model, region, scope and rate before any provider is called.
Signed policy provenance
The policy bundle is built and signed in CI and recorded in the Sigstore transparency log. The gateway loads it only after the signature checks out.
Evidence you verify yourself
Each decision, allowed or denied, is signed into the tenant's hash chain. Check a record in your browser or export a pack and verify it offline.
17 scenarios, each a real request.
Each one sends a real request through the gateway and checks the decision against what the policy should do.
- 01Approved request, evidence recordedAllowed · 200Run
- 02App exceeds its permissionsDenied · 403authz.missing_scopeRun
- 03Data leaves the approved regionDenied · 403residency.jwt_region_mismatchRun
- 04Unknown business unit uses AIDenied · 403model.tenant_not_configuredRun
- 05Unapproved AI modelDenied · 403model.not_allowedRun
- 06Stale credentials usedDenied · 401authn.invalid_tokenRun
- 07Credential used in the wrong placeDenied · 401authn.invalid_tokenRun
- 08Credentials from an untrusted sourceDenied · 401authn.invalid_tokenRun
- 09Tampered credentialsDenied · 401authn.invalid_tokenRun
- 10Anonymous AI usage blockedDenied · 401authn.missing_tokenRun
- 11Unmapped endpoint refusedDenied · 403refused at the gatewayRun
- 12Usage limit, enforced and recordedDenied · 429rate.tenant_limitRun
- 13A second AI vendor, added without codeAllowed · 200Run
- 14Agent pays within policyAllowed · 200Run
- 15Over the per-payment capDenied · 403spend.per_tx_cap_exceededRun
- 16Merchant not on the allowlistDenied · 403spend.merchant_not_allowedRun
- 17Daily budget exhaustedDenied · 403spend.budget_exceededRun
See the signed evidence yourself.
Every decision these scenarios make is signed. The console's demo data is visible to every guest.
- Step 1
Open the console
Choose “Continue as guest auditor”. No password; read-only for 30 minutes.
- Step 2
Verify a record in your browser
Open any decision under Evidence. Its signature and chain link are checked right in the page.
- Step 3
Export and verify offline
Export a signed evidence pack and check it on your own machine with the included script, without trusting PolicyGate.