Policy-Driven Governance

Every call authenticated, authorized, and logged.

Auth enforced at both edges of the gateway, inbound requests and outbound credential use, under one consistent policy layer.

  1. Inbound requestFrom an agent or app
  2. VerifyJWT, OIDC, or API key
  3. Policy pluginsPII redaction · Rate limits · RBAC
  4. Credential brokeredInjected by the gateway
  5. UpstreamAPI, MCP server, or LLM
Auth is enforced at both edges of the gateway, and every step is written to the same audit log.
2
edges enforced: inbound and outbound
3
inbound auth methods: JWT, OIDC, API key
1
plugin catalog across APIs, MCPs, and LLMs
0
custom middleware to compose policies

The problem

Without a central enforcement point, governance ends up implemented per team and per service, inconsistently. Some routes get real RBAC, others get whatever the last engineer had time to add.

How it works

At the edge, every inbound request is verified before it reaches any upstream (JWT, OIDC, or API key). On the way out, Fabric brokers the right upstream credential itself, so the agent never handles it. RBAC, scope gates, and audit logging apply the same way on every route.

What you get

Inbound verification

JWT, OIDC, or API key, checked before the upstream ever sees the request.

Outbound credential brokering

Transparent to the calling agent.

Uniform RBAC and scope gates

Enforced once at the gateway, not per integration.

Uniform audit logging

The same audit trail across every route.

Policies as plugins

Governance isn't one fixed ruleset. It's a set of policies you attach to a route, and the same plugin attaches identically whether that route is an API, an MCP server, or an LLM call. There's no separate configuration surface per workload type.

PII redaction plugins

Strip or mask sensitive fields from a request or response before it crosses the gateway, applied the same way on an internal API call as on an LLM prompt.

Rate limit plugins

Cap calls by token count, request count, or cost, per user, team, or route.

Composable

Attach several to one route (for example PII redaction, rate limiting, and RBAC) without writing custom middleware.

One plugin catalog

The same catalog and attachment model across APIs, MCPs, and LLMs. Write a policy once, reuse it everywhere.

Bring every AI interaction under control

Connect your first model, MCP server or internal API and apply consistent governance from one gateway.

Sign upRead the docs