Decide what
every agent / can do.
Finding your AI agents is the first step. SlashID goes further — every MCP tool call is authorized against the identity behind it, every delegated token is downscoped to the task, and every decision lands on the same access graph as your people, service accounts and OAuth apps.
Who delegated, which agent acted, which tool ran — and why it was allowed.
Discovery doesn't stop the tool call.
An agent is an identity with initiative. It holds tokens, picks its own tools, and acts for a person who never sees the call. An inventory tells you the agent exists. It does not tell you whether this user, through this agent, should be running this tool with these arguments right now. That decision has to be made inline, against real identity — and it has to leave proof.
Discover, identify, decide, prove.
Discover the AI surface
Every OAuth app, agent, model, MCP server and tool — declared or merely observed — lands on the access graph, agentlessly.
Identify the caller
Gate resolves the verified token to a person or non-human identity, with groups, tags and the delegation chain behind it.
Decide per call
Policy runs inline on each MCP request: tool, resource, prompt, arguments, identity and budget. Allow, deny or rate-limit.
Prove it
Every decision is recorded with who, which agent, which tool and which policy line — and drafts are replayed before they ship.
Delegation, not impersonation.
/On-behalf-of, by design
Standards-based token exchange (RFC 8693) where the acting agent must always present its own credential. The user stays the subject; each agent is recorded as an actor — across up to five hops.
/Least privilege at every hop
Scopes must be a subset of what the user was granted, audiences must be on the allow-list, lifetimes only get shorter. Set a different scope and audience per route. Escalation fails closed.
/Workload identity on the fly
A SPIFFE-attested agent becomes a first-class actor at request time — trust the domain once, never pre-register each workload. Tokens are minted per request, with no refresh token to steal.
/Chains you can't forge
Spliced delegation histories are refused, cross-organization exchanges are denied, and every denial is logged with both identities and the reason. The upstream never sees the original credential.
"sub": "[email protected]" "scope": "crm.read" ← narrowed "aud": "mcp.acme.com/crm" ← this route only "exp": now + 5 min ← only shorter "act": { "sub": "spiffe://acme.prod/billing-agent" "act": { "sub": "support-agent" } }
Inventory tools see it. Gateways block it. SlashID knows who it is.
● full ◐ partial ○ none. Category comparison based on publicly documented capabilities; individual products vary.
Built for how AI actually connects.
MCP tool-level authorization
Allow or deny by tool, resource, prompt or argument — inline, on every call. Batched requests can't smuggle a forbidden tool past policy.
Policy builder with dry-run
Author rules against the tools your traffic actually carries, replay drafts over recorded requests, and keep every revision. Drop to Rego when you need to.
Identity-aware decisions
Policies key on groups, tags and attributes from the identity graph — for people and agents alike — never on an unverified token.
AI inventory & tool reachability
Models, agents, tools and MCP servers across Anthropic, OpenAI and Amazon Bedrock — with who can reach which tool, directly or through an agent.
Spend & token budgets
Token or dollar limits per identity, team or organization, scoped by graph query. Monitor, block at the gateway, or sync to Anthropic's native spend limits.
Native Claude & Codex policies
Request-time rules for the assistants your teams already use: which models, which MCP tools, which uploads, and when.
AI threat detection
Prompt attacks, data exfiltration and sensitive data sent to AI — detected on the invocation stream and tied back to the identity responsible.
Conversation capture & redaction
Choose metadata, redacted or verbatim capture per connection, with retention and a change audit trail. PII and secrets are masked in flight.
Provider-key isolation
Agents call through Gate with a proxy credential; the real provider key is swapped in at the edge and never reaches the agent.
Pairs well with.
Threat detection & posture
AI-evaluated detection and continuous posture management across humans, non-human identities and agents.
Explore use case →Access reviews
Certify non-human and AI-agent access alongside humans — on the graph, not in a spreadsheet.
Explore use case →Stop impersonation attacks
Cryptographic mutual verification that replaces perception-based trust with mathematical proof.
Explore use case →
Put a policy
on every / tool call.
Run agentless discovery, point your MCP traffic at Gate in monitoring mode, and see exactly what a policy would have blocked — before you enforce a thing.