Product
Gateplex sits between your AI agents and the systems they act on. Every action is intercepted, evaluated against your rules, and assigned a verdict before it reaches the target. The client cannot override the server verdict.
Agent sends action
Gateplex evaluates
Verdict returned before execution
Observability
Every agent action is captured in real time with full context. Each intercept record stores the agent identity, model name, input payload, output, verdict, triggered rule name, transaction amount if detected, PII types detected if any, and a server-measured timestamp. Records are immutable from the moment of creation.
The Live Feed shows intercepts as they arrive across all agents and projects in your organisation. Filter by verdict, agent, date range, or rule. Every record is queryable and exportable.
Nothing your agents do happens without a complete, verifiable record behind it.
Enforcement
Guardrail rules are evaluated server-side on every intercept before the verdict is returned. The client cannot send a flag that overrides the server evaluation. This has been verified in production: a request sent with flagged set to false was overridden to blocked by the server when a spend limit rule was triggered.
The evaluation engine is entirely deterministic. No LLM is involved in the evaluation path. Rules evaluate in consistent, auditable logic that produces the same result for the same input every time. This makes verdicts defensible to a regulator in a way that probabilistic systems are not.
Two of the ten built-in rule types:
Extracts monetary amounts from agent input using pattern matching and blocks any action that exceeds your configured threshold. Evaluated on every intercept regardless of what the client sends.
Scans both input and output for email addresses, phone numbers, social security numbers, credit card numbers with Luhn validation, and street addresses. Forces a block verdict if any pattern matches.
See the full list of all ten rule types below.
Define your own enforcement policies using configurable thresholds, regex patterns, and allow or deny lists. Custom rules run alongside built-in rules on every intercept.
Verdicts
Every intercept receives one of three verdicts.
The action is within policy. The agent proceeds normally. Zero additional latency impact on compliant operations.
The action matches a rule configured to flag. By default it proceeds and is logged for review. If that rule also requires approval, the action is held instead: the engine returns PENDING_APPROVAL and a named reviewer must approve or reject it before it executes.
The action violates a rule. It is stopped before execution. A full compliance record is generated. The agent receives an explicit block response and should not proceed.
Evidence
Every intercept and verdict is written to a tamper-evident audit trail at insert time. Each record stores a SHA-256 hash of its own content and the hash of the preceding record. If any record is modified or deleted after the fact, the chain breaks and the tampering is detectable at report generation.
Compliance PDF exports are generated on demand, scoped by agent, project, and date range. Reports include a verified chain integrity check, a full intercept summary, verdict distribution, triggered rules, and a signed hash of the complete dataset.
Reports are formatted specifically for regulatory review under EU AI Act Articles 12 and 14, SOC 2 Type II evidence collection, HIPAA audit requirements, and GDPR processor obligations. The output is designed for legal teams and auditors, not engineering dashboards.
Integration
Send intercept data from any agent with a single POST request to the Gateplex API. No SDK required. No framework changes. No architectural rework.
The API accepts event type, agent ID, input, output, model name, and metadata. Only event type is required. Everything else is optional and can be added incrementally.
Any language, any framework. If your code can make an HTTP call it can use Gateplex.
POST https://gateplex.ai/api/public/intercepts
Authorization: Bearer gplx_...
Content-Type: application/json
{
"event_type": "tool_call",
"agent_id": "treasury-ops-01",
"input": "wire_transfer $48,200 USD",
"output": null,
"model": "gpt-4o",
"metadata": { "env": "production" }
}Supported models and frameworks: OpenAI, Anthropic, Vertex AI, AWS Bedrock, LangChain, CrewAI, AutoGen, and any other framework that can make an HTTP call.
Governance Rules
Compose governance from ten rule types that evaluate every intercept server-side before a verdict is returned.
Extracts monetary amounts from agent input using pattern matching and blocks any action that exceeds your configured threshold. Evaluated on every intercept regardless of what the client sends.
Scans both input and output for email addresses, phone numbers, social security numbers, credit card numbers with Luhn validation, and street addresses. Forces a block verdict if any pattern matches.
Blocks any agent action whose input or output contains one of your configured words or phrases. Use it to stop banned terms, restricted product names, or unsafe instructions before they execute.
Flags actions that contain configured words or phrases without blocking them. The action proceeds but is marked for review, making it ideal for monitoring sensitive topics.
Caps how many actions an agent can perform within a time window. Prevents runaway loops, abusive traffic, and unexpected cost spikes from a misbehaving agent.
Restricts which domains and endpoints an agent is allowed to call using an allowlist or blocklist. Keeps agents inside the boundaries you approve.
Blocks or flags payloads that match a custom regular expression. Gives you precise control over structured patterns such as account numbers, tokens, or internal identifiers.
Blocks agent outputs that exceed a configured character count. Guards against data exfiltration through oversized responses and keeps outputs within expected bounds.
Automatically flags common prompt injection and jailbreak attempts so you can review actions that try to override your agent's instructions.
Flags when an agent sends the same payload repeatedly within a window. Surfaces stuck loops and duplicated actions that signal a malfunctioning agent.
Regulatory Blueprints
Apply a curated set of pre-configured rules in a single step.
A bundle of pre-configured rules that map to the record-keeping and logging obligations of EU AI Act Article 12 for high-risk AI systems.
Pre-configured PII and disclosure rules tuned for healthcare workloads, helping protect protected health information across agent actions.
Spend limits, transaction boundaries, and data access rules pre-configured for financial workflows and audit requirements.
Operations
Held actions and rule changes are both accountable to a named human and a verifiable hash chain.
FLAG rules can be configured to require human approval before the agent action executes. When approval is required, the governance engine returns PENDING_APPROVAL and the action is held instead of proceeding.
Held actions appear in the approval queue, where named reviewers can approve or reject each one. Every decision records the reviewer email against the action, giving you a clear, accountable trail of who approved what and when.
Every change to a governance rule is logged with the admin email, a timestamp, and the previous and new state of the rule. Creations, edits, enables, disables, and deletions are all captured.
The log uses SHA-256 hash chaining so each entry references the hash of the entry before it. If any record is altered after the fact, the chain breaks and the tampering is detectable.
Deployment
Gateplex is available in three deployment configurations depending on your data sovereignty and compliance requirements.
The default configuration. Gateplex Cloud handles infrastructure, uptime, and updates. Live in under five minutes. Suitable for teams moving fast and organisations with EU, US, GCC/MENA, or customer-chosen data residency requirements.
The Gateplex governance engine runs entirely inside your AWS or Azure environment. Agent payloads, audit logs, and governance decisions never leave your perimeter. Policy synchronisation uses an encrypted outbound-only tunnel. Available today on Enterprise plans. Deployment is scoped with our team.
Available today, fully self-hosted with no outbound connections. For financial institutions, healthcare systems, and government-adjacent organisations with strict data sovereignty requirements. Contact us for setup and pricing.
Industries
Gateplex is designed for organisations where agent failures have legal, financial, or regulatory consequences.
Enforce spend limits, transaction boundaries, and data access controls on every agent action. Every decision is logged with full context for AML, KYC, and financial audit requirements. Built to support the governance, audit trail, and human oversight requirements financial institutions face under frameworks such as Qatar Central Bank's AI Guideline and SAMA's Cyber Security Framework.
Detect and block PII exposure on every intercept. Generate HIPAA-compliant audit evidence for prior authorisation, claims processing, and medical underwriting agent deployments.
If you are building AI agent capabilities into your product, Gateplex is the compliance layer you embed to satisfy your enterprise customers' procurement and security requirements.
Every action intercepted, evaluated, and recorded before it reaches a production system.