The parts, and who trusts whom
- The Control Plane holds each organization's configuration, approvals and audit trail. Only it uses the database.
- Gateways enforce the policy and call your systems. A Gateway in your network only connects out to the Control Plane; nothing connects in to it from outside.
- The console is a website that talks to the Control Plane on your browser's behalf, so your session cookie belongs to the console's own address.
Organizations are kept apart
Every query the Control Plane makes is limited to the signed-in person's organization, and the limit fails closed: a query without it returns nothing. Another organization's resources answer as if they didn't exist. Gatelion's own back office sees organizations' status, usage counts and activity dates, never their agents, approvals or data.
What agents can do
- Tokens. Each agent has its own random 256-bit tokens, stored only as hashes, limited to one environment, with an expiry, and revocable at once.
- Who it acts for. Every call names the person it's for, who must be on the agent's list.
- Default deny. A call no rule allows is refused, and the agent doesn't even see tools the policy could never let it use.
- Strict input. Arguments are checked against each tool's schema, with unknown fields refused. Text is normalized before it's compared, so look-alike characters and other digit systems can't slip past a rule.
- Limits. Calls are rate-limited per agent and per tool.
Approvals
- Bound to the exact call. An approval covers one set of arguments, identified by a fingerprint, and one version of the tool and the policy. Change any of them and it no longer applies.
- Someone else decides. The person the agent acts for, the agent's owner and whoever issued its token can't approve its requests.
- Re-checked before running. After approval, the Control Plane checks the policy, tool and agent again, then issues a signed grant that expires after 60 seconds. The Gateway verifies it against a key it pinned when it registered, and sends the request once.
- Cancelled when things change. If the tool or policy changes, or the agent or approver is stopped, waiting requests are cancelled with the reason.
- Encrypted. The arguments of approval requests are encrypted in the database, and only approvers and auditors can see them, each view being recorded.
The Gateway's copy of your configuration
Gateways work from a snapshot of the configuration that the Control Plane signs. A Gateway checks the signature against the key it pinned at registration, refuses older or foreign snapshots, and keeps only verified ones. If it loses contact, it keeps deciding for a limited time, set per environment, then refuses writes, and later reads too.
Calling your systems
- Only where you said. A Gateway only calls the hosts you allowed for each connection, never follows redirects, and checks the address it actually connects to. That stops a lookup from pointing it elsewhere.
- Private networks. A Gateway in your network reaches only the private ranges you allowed. Gatelion's hosted Gateway can't reach private networks at all.
- Uncertain results. Responses have size limits. When a write's result is uncertain, it's marked unknown and never retried automatically.
Your systems' secrets
- Gateway in your network: secrets live only in its settings file on your machine. Gatelion only knows their names, and a secret can be limited to the hosts it may be sent to.
- Hosted Gateway: you type the secret, and your browser encrypts it to the hosted Gateway's key, for that connection and its hosts only. The Control Plane stores what it can't read, and secrets are never shown again.
- Hidden in results: fields named like secrets, and fields a tool marks sensitive, are hidden from agents' results and the audit trail.
Signing in
- Passwords are stored as salted PBKDF2 hashes. Repeated failures lock the account for a while.
- Second factor. Admins and approvers must use one: an authenticator app or a passkey, with recovery codes.
- Company login. Organizations can use their own login (OpenID Connect) instead, with its own multi-factor rules.
- Sessions last at most 12 hours, and end when someone's access is removed or their password changes.
The audit trail
Requests, decisions, approvals, results and administrative changes are recorded as events. Each environment's events form a hash chain, so changing, removing or reordering one breaks it. The console verifies the chain on demand. The application's own database account can add events, but can't change or delete them.
In transit
The console, the Control Plane and the hosted Gateway are served over HTTPS. A Gateway in your network serves HTTPS with your own certificate. If one runs on plain HTTP, the console marks it, because agents' tokens would cross your network unencrypted. See Install a Gateway.
Known limits
- The Gateway packages aren't code-signed yet. The console shows each download's SHA-256 checksum, and the install commands verify it.
- A secret whose field name gives no hint, such as
value, is only hidden if the tool marks that field sensitive. - Gatelion relies on your company login's multi-factor policy for people who sign in with it.
Reporting a vulnerability
Write to contact@gatelion.si with what you found and how to reproduce it. Please give us a chance to fix it before you share it. We'll confirm we received it and keep you updated.