Frequently asked questions

Gateplex is a real-time governance firewall for autonomous AI agents. It intercepts every agent action before it executes, evaluates it against deterministic rules, and returns a verdict before the action completes.

Langsmith and similar tools focus on developer-side tracing and debugging. Gateplex sits in the runtime path of your agents and actively enforces governance rules (block/flag financial actions, mask PII, prevent prompt injection), in addition to producing a regulator-ready audit trail.

Most teams ship a first intercept in under 10 minutes - a single POST request from your agent to /api/public/intercepts with your API key.

Only the smallest possible change: one HTTP call (or one SDK function call) per intercept. You don't have to restructure your agent or move to a new framework.

Anything that runs in your stack: OpenAI, Anthropic, Vertex AI, AWS Bedrock, plus orchestration frameworks like LangChain, CrewAI, and AutoGen. Gateplex is model- and framework-agnostic - if your code can make an HTTP call, it can use Gateplex.

Send your project API key as either Authorization: Bearer gplx_... or X-Gateplex-Api-Key: gplx_.... Generate keys in Dashboard → Settings → API Keys.

Only event_type is required. Optional: agent_id (uuid), input, output, model, latency_ms, flagged, metadata.

A JSON object: { "ok": true, "intercept": { "id": "...", "created_at": "...", "event_type": "...", "flagged": false } } with HTTP 200.

400 invalid payload, 401 missing/invalid API key, 429 rate limit exceeded, 500 internal error. All errors return JSON with an `error` field.

Yes. Log a single intercept after the stream completes with the assembled output, or log per-chunk if you need fine-grained tracking.

Yes - gateplex-python on PyPI. A TypeScript SDK is on the roadmap. You can also call the REST API directly from any language.

Gateplex exposes an MCP server at https://gateplex.ai/mcp with three tools: log_intercept, get_feed, check_guardrails. Install via Smithery or point your MCP client at the endpoint with your Gateplex API key as a bearer token.

Send a test intercept with event_type 'llm_call' from curl, then check the live feed in your dashboard. You should see it appear within a second.

The SDK response includes a verdict field returning ALLOW, FLAG, BLOCK, or PENDING_APPROVAL. It also returns reasoning, triggered_rules, pii_types_detected, and transaction_amount. Convenience properties include is_blocked, is_allowed, is_flagged, and is_pending_approval.

A guardrail is a rule that evaluates every intercept in real time and decides whether to ALLOW, FLAG, or BLOCK the action. Gateplex ships with ten built-in rule types, including Spend Limit and PII Shield, plus support for fully custom rules.

PII Shield scans inputs and outputs for personally identifiable information (emails, phone numbers, SSNs, credit cards). Depending on your rule configuration, a match returns a FLAG or BLOCK verdict, and the detected PII can optionally be masked in the stored audit record.

When a FLAG rule has requires_approval enabled, the governance engine returns a PENDING_APPROVAL verdict instead of FLAG. The agent action is held until a named human reviewer approves or rejects it in the Gateplex dashboard. Every decision is recorded with the reviewer email and timestamp. The Python SDK supports automatic polling via client.wait_for_approval(intercept_id).

Every change to guardrail rules is logged automatically with the admin email, timestamp, and full before and after state. The log uses SHA-256 hash chaining for tamper evidence. It is visible on the Audit Log page and exportable as CSV.

Yes. Define rule_type, configuration (thresholds, regex, allow/deny lists), and whether the rule flags or blocks. Custom rules run alongside built-ins.

The intercept is recorded with the matching rule, the verdict is returned to your agent, and (if configured) an alert is sent to your team. Blocked actions stop before execution.

BLOCK stops the action from executing before it runs. FLAG rules log the action and let it proceed by default; if that rule also requires approval, the action is held instead and a named reviewer must approve or reject it before it executes.

Yes. Evaluation happens synchronously as part of the intercept request, before your agent receives a verdict.

The verdict is returned in the same HTTP response as the intercept acknowledgement, before your agent takes any action.

Gateplex supports ten rule types: Spend Limit, PII Shield, Keyword Block, Keyword Flag, Rate Limiter, API Scope Control, Regex Pattern Match, Output Length Limit, Prompt Injection Detector, and Repetition Detector. Three compliance packs are available that add multiple pre-configured rules at once: EU AI Act Article 12 Pack, HIPAA Safety Pack, and Financial Services Pack.

Flagged actions can be configured to require human approval before the agent action executes. When requires_approval is enabled on a rule, the action is held in the approval queue. A named reviewer must approve or reject it. Every decision is logged with the reviewer email and timestamp.

When a FLAG rule has requires_approval enabled, the governance engine returns PENDING_APPROVAL instead of FLAG. The agent action is held until a human reviewer approves or rejects it in the Gateplex dashboard. The Python SDK supports automatic polling with client.wait_for_approval(intercept_id).

Only if you send them. Input/output fields are optional. If sent, they are stored encrypted and retained according to your plan's retention policy.

Only members of your organization with the appropriate role. Row-level security enforces project isolation at the database layer.

TLS 1.3 in transit, AES-256 at rest. API keys are stored hashed.

Yes. You can delete individual intercepts, entire projects, or your whole account from the dashboard. Deletion is permanent within 30 days.

Gateplex follows SOC 2 security controls including encryption at rest and in transit, access control, and audit logging. A formal SOC 2 certification is on our roadmap. We can share our current security posture document on request. Email security@gateplex.ai.

Yes. We act as a processor for customer data, support DSAR fulfillment, and offer EU, US, and GCC/MENA data residency options on Enterprise plans.

Gateplex is designed to help you comply with EU AI Act obligations around logging, transparency, and human oversight for high-risk AI systems. Our audit trail and compliance exports map to Article 12 and Article 14 requirements.

Yes. Gateplex VPC Edition runs the governance engine entirely inside your own AWS or Azure environment. No agent payload data leaves your perimeter. Available on Enterprise plans on request.

5,000 intercepts/month, 3 agents, 1 project, basic audit log, community support.

Yes. Unlimited intercepts, custom retention, SSO, EU data residency, dedicated support, and a signed BAA/DPA. Contact sales@gateplex.ai.

Every successful POST to /api/public/intercepts counts as one intercept. The counter resets on the first of each calendar month UTC.

On the free tier, additional intercepts return 429 until the next reset. Enterprise capacity is agreed as part of your deployment scope.

There is no self-serve upgrade. Contact sales@gateplex.ai for a deployment assessment, and we scope capacity, residency, and support terms with you.

The Free tier has no charge. Enterprise plan refund and billing terms are set out in your service agreement. See our Refund Policy for details.

Evaluation happens synchronously in the request path with minimal overhead. Exact latency depends on your deployment configuration and rule complexity.

99.95% on Enterprise with credits for missed SLOs.

Our SDKs and recommended integration pattern fail open by default - your agent continues to function and intercepts are queued for replay. Fail-closed mode is available for strict-compliance workloads.

Yes. The API is built on edge infrastructure and scales horizontally. Customers run sustained high-volume workloads in production.

Free: 60 req/min per project. Enterprise: custom, burstable to your agreed capacity.

An append-only, hash-chained log of every intercept and every guardrail verdict. Records cannot be modified or deleted without breaking the chain.

A signed PDF summarizing all intercepts, guardrail events, and verdicts for a given project and date range - formatted for auditors and regulators.

Dashboard → Compliance → Export → choose project and date range → Generate PDF. Reports are also available via API on Enterprise.

EU AI Act (Articles 12, 14), NIST AI RMF, ISO/IEC 42001, GDPR processor obligations, and internal SOC 2 evidence collection.

Free: 7 days. Enterprise: custom (1 to 7 years).

Yes. The Rule Change Audit Log records every rule creation, edit, enable, disable, and deletion with the admin email, timestamp, and full before and after state. The log uses SHA-256 hash chaining for tamper evidence.