Treat every model like a capable insider that can make mistakes or be tricked. The model provider supplies the intelligence. You keep the authority.
Budgets, allowed tools and end dates live in SatGate, not in a prompt or a provider's settings. SatGate checks each request against them before it reaches the service. In Control, a request outside those limits is refused. Observe records it and does not block on budget.
SatGate signs a receipt when it refuses an agent over a budget, a missing payment or a tool permission, and when an agent spends from a budget in Control. The agent never writes or edits its own record. A SatGate Cloud receipt can be checked with the open-source verifier against our published keys.
Revoke an agent and its next request is refused, along with any helpers it handed work to. If a revoke can't be confirmed, the dashboard says so instead of showing it as done.
The same limits and receipts apply whichever model or vendor runs your agents.
Self-hosted SatGate runs on your own servers and database and takes no rules from SatGate Cloud.
The same token limits what an agent can do and spend, and its history shows who handed work to whom, whether the call stays inside your company or goes to a paid service outside it.
Your Agents (Internal)
No token, no action. SatGate checks what each agent can do, spend and hand off before the request reaches your API.
Their Agents (External)
Approved external agents consume your APIs with scoped, expiring access instead of long-lived shared secrets, with per-request policy and pricing over L402 or x402 (USDC on Base).
Receipts for both
SatGate signs receipts for your agents and for external agents. Your auditor can check them with the open-source verifier and SatGate's published keys, with no need to trust the AI company.
Security. Finance. Platform.
Scoped authority, enforceable limits, and signed receipt proof for autonomous agent work.
The problem: Shared API keys and pooled model bills hide which agent, route, token, or workflow created spend.
Metrics that matter:
Attribute spend to agent, token, route, tool, and policy before finance has to reconstruct it
The problem: Agents now hold authority that used to require human approval. Security needs proof that scope, delegation, denial, and revocation actually worked.
Metrics that matter:
Prove unauthorized actions were blocked before data or spend moved
The problem: Agents are moving across internal APIs, MCP tools, and paid external rails. Governance cannot depend on which protocol the agent used.
Metrics that matter:
One control path for internal workflows and governed external paid calls
Start with visibility, move enforcement to before the request goes through, then export the signed receipt (Evidence Pack) when security, finance, or compliance asks what happened.
See every agent token, route and MCP tool in use, and what it costs, before you enforce limits.
Enforce scoped capabilities, budgets, tenant boundaries, delegation depth, expiry, and revocation before the next request reaches an API or MCP tool.
Export your signed receipts, each with its decision, refusal code, and budget or payment details.
Friday afternoon, the finance-automation parent agent delegates too much authority to an invoice-reconciler worker. The worker tries to export customer data and call an enrichment payment method outside its scope. SatGate changes the ending by refusing before the request goes through and signing a receipt.
“Just a quick test.” The invoice-reconciler worker gets broad authority: no narrow scope, no expiry, no delegation chain, no customer-data caveat.
The worker calls an unauthorized MCP export tool and a paid enrichment rail outside its invoice-matching scope. Logs exist, but nobody can prove which authority allowed it.
SatGate checks the worker's token limits before the request goes through. The scope and spend checks fail, so the export never executes and the paid call never settles.
One click revokes the finance-automation parent, and with it the invoice-reconciler child. The next request after a revoke is refused.
SatGate signs a receipt for the refused export and the refused paid call. You can export the receipts and check them later.
Turns a silent authority failure into a blocked action with a signed receipt.
Govern first. Enforce before execution. Check the receipts afterward.
See your agents' calls, refusals, revokes and spend in the dashboard, and export receipts when you need proof.
See your agents' tokens, what each one may call and the budget it has left.
See what each agent token spent, on which route or tool.
See which calls SatGate refused and which tokens you revoked.
Export your signed receipts, each with its decision, refusal code, and budget or payment details.
The same invoice-reconciler example: a root policy hands work to a parent agent, then to narrower workers. Every level is scoped, budgeted and time-limited, and the token's history shows who handed work to whom.
Finance automation • tenant scoped • revocable
invoice:*
$10k/mo
payment:approve
$5k/mo
evidence:export
read-only
invoice:match
vendor:read
document:ocr
evidence:write
Narrower than parent
Hard spending limits
Auto-expire by policy
Sub-delegation stays inside caveats
No JVM and no language runtime. One binary, with Postgres and Redis for budgets and revocation.
ghcr.io/satgate-io/satgate (open source)
Helm chart included
cloud.satgate.io
Start on SatGate Cloud at cloud.satgate.io. Enterprise self-host runs the same SatGate binary, with its own database, in your own environment.
When agents share broad API keys, nobody can tell which agent did what, which team owned it, or where a limit should have stopped it. Limits start with knowing who holds access.
Internal services now get requests from agents, not only from people and apps. SatGate checks those requests before they run and signs receipts you can check later. It's not just usage tracking. It's rules and receipts for AI agents.
See which agent tokens, routes and tools are in use, and what they cost, before you enforce limits.
Policy, caveats, budgets, and revocation run before the request goes through, and before the agent reaches the upstream service.
Export signed receipts and check them with the open-source verifier.
“Stop giving AI agents standing authority.”
Give them scoped capabilities. Enforce policy before execution. Export proof after.
SatGate Mint exchanges workload identity tokens for capability-bearing macaroons. The same Mint flow works for internal calls and governed external paid calls. Each grant is recorded in the audit log.
The same exchange works the same way for one agent or thousands. Agents get tokens from the identity they already have, so there are no shared API keys to rotate.
Map identity claims to budgets, scopes, and TTLs. One policy per agent class — not per agent instance.
Each agent reads its environment identity (K8s SA, IAM role, OIDC token) and exchanges it for a macaroon. One API call. No human in the loop.
Export the receipts SatGate signed, and use them when you need to prove what happened.
# Agent startup (3 lines, works in any runtime)
IDENTITY=$(cat /var/run/secrets/tokens/satgate-token)
TOKEN=$(curl -s -X POST $SATGATE_MINT_URL \
-d "{\"credentials\": \"$IDENTITY\"}" | jq -r '.macaroon')
export SATGATE_TOKEN=$TOKEN
# That's it. Agent connects through SatGate with budget-scoped access.Governance rollout kit
High-level AI governance only matters when it becomes enforceable policy: identity, budgets, scoped credentials, MCP tool limits, revocation, and signed receipt proof before agents act.
Find static-key blast radius before autonomous agents inherit unlimited API access.
Score identity, budgets, MCP governance, revocation, delegation, signed receipts and payment readiness.
SDKs, receipts and how to put SatGate in front of your tools.
Treat MCP tool calls as governed events with per-tool prices, caps, denial reasons, and evidence.
FAQ
AI agent governance is the set of controls that determines which agents can call which APIs, tools, and models; how much they can spend; what authority they can delegate; and when access must be revoked. For autonomous agents, governance needs enforcement before the request goes through, not just logs and dashboards.
Rules and receipts for AI agents sit before the request goes through. They apply scopes, budgets, delegation rules, and revocation before an agent reaches an upstream API, model, or MCP tool, then keep signed receipts anyone can check later.
Enterprises should govern MCP tools with per-tool budgets, scoped capability tokens, task and tenant attribution, signed receipts (Evidence Packs), revocation, and hard policy decisions before the request goes through. Rate limits and dashboards are useful, but they do not replace enforcement before tool calls execute.
AI governance usually covers model risk, data policy, compliance, and human review. AI agent governance adds controls on each request that goes through SatGate for autonomous actions: scopes, budgets, delegated permissions, revocation, denial reasons, spend attribution, and proof before APIs or MCP tools execute.
Lightning (L402) and USDC on Base (x402) are live. On each paid route, the owner picks Lightning, USDC, or both. AgentCore Payments and Pay.sh are planned. Payment never overrides permissions.
Start with Observe, then move to Control and export receipts when you're ready.
Observe first • Enforce next • Export proof when it matters