Support agents
Card numbers, emails and promises you can't keep are caught before the reply leaves.
G3-PII-CARDG5-BINDING-COMMITMENTG8-HUMAN-IMPERSONATION
Deterministic policy gate for AI agents
Check every agent output. Keep the receipt.
AgentGate runs 50 published rules — 47 of them mapped to a specific provision, from GDPR and the EU AI Act to PCI DSS — on anything your agent is about to say or do. One call returns a verdict in milliseconds and a signed, hash-chained receipt an auditor can check without taking your word for it.
10,000 validations a month freeNo cardEnglish, Russian and Uzbek patterns
Agent output
auto-play
Loading the rule engine…
8 gates
- G1Output Integrity·
- G2Security·
- G3Data Protection·
- G4Action Safety·
- G5Legal·
- G6Financial Conduct·
- G7Explainability·
- G8Ethics & Transparency·
engine 2.0.0
50 rules · no model in the loop
Allow
Waiting for input
Nothing to report yetPick a sample or type your own.
50published rules, 47 mapped to a specific provision
8gates, from data protection to action safety
30laws, standards and cases cited
0models in the loop — same input, same verdict
01Why now
The rules for AI agents now have dates.
For years "AI governance" meant a policy document. Now specific duties apply on specific days — and a regulator, an auditor or a judge asks the same question each time: show me what your agent said, and what checked it.
-
Manipulation is prohibitedEU AI Act Art. 5 bans manipulative and exploitative techniques.
G8-MANIPULATION -
Uzbekistan: no AI-only decisionsLaw ZRU-1115 — legally significant decisions may not rest solely on an AI's conclusion.
G8-AUTOMATED-DECISION -
AI has to say it is AIEU AI Act Art. 50 applies. Fines reach €15M or 3% of worldwide turnover.
G8-HUMAN-IMPERSONATION -
High-risk: logs and oversightArts 12, 14 and 26 apply to Annex III systems — automatic logs kept at least six months, and a person who can intervene.
receiptsreview
Summaries, not legal advice. EU dates per Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Uzbekistan per Law ZRU-1115 (Informatization Law, Art. 7¹).
02How it works
One call. One field to branch on. One receipt to keep.
1Check
Send what the agent is about to say
Only agent_output is required. Add context to narrow the gates, or a policy to switch rules off.
curl https://agengate.com/v1/validate \ -H "X-API-Key: $AGENTGATE_KEY" \ -H "Content-Type: application/json" \ -d '{ "agent_output": "Your loan application has been declined." }'
2Decide
Branch on the verdict
Your code handles four cases, not 50 rules. Each finding names its rule and, where there is one, the provision behind it.
switch (result.verdict) { case "allow": return send(output); case "redact": return send(result.redacted_output); case "review": return holdForHuman(result.id); case "block": return refuse(); }
3Prove
Keep the receipt
It records which rules ran, what they found and which receipt came before — and never the text itself.
{
"verdict": "review",
"evaluated": 50,
"findings": [{ "rule": "G7-NO-RECOURSE", … }],
"ruleset": "sha256:4c1e…",
"seq": 412, "prev": "sha256:93c5…",
"hash": "sha256:a41f…",
"signature": { "alg": "Ed25519", … }
}
Allow
Nothing matched, or only advisories. Send it as written.
status: "passed"
Redact
Personal or payment values were found. Send the masked version that comes back.
redacted_output
Review
A decision, a promise or an action that needs a person. Hold it until someone signs off.
POST /v1/overrides
Block
A leaked key, a guaranteed return, an agent claiming to be human. It does not go out.
status: "failed"
03The rulebook
Eight gates. Every rule in the open.
No black box and no model to second-guess. Each rule states what it matches, what it does, how literal it is and which provision, if any, it supports. The list below is rendered from the engine itself, so it cannot drift from what runs.
Output Integrity
The output is finished and carries no machinery: no placeholders, leaked prompts, stack traces or destructive commands.
04Evidence
A receipt proves what was checked — and contains none of it.
Logs are easy to edit and awkward to share. A receipt is small, safe to hand to an auditor, and wrong the moment one character changes.
subject.commitmentA salted hash of the output. On its own it reveals nothing; with the salt you keep, it proves the receipt is about this exact text.rulesetThe hash of the exact rules that ran. Change one pattern and it changes.checks_rootOne hash over every check's result. Anyone can recompute it from the public catalogue.prev · seqEach receipt points at the one before it. Remove or reorder one and the chain breaks.signatureEd25519, verifiable offline against the key we publish.
RECEIPT#000412
- id
- val_8f2c41d0a97be3f25c10b6aa
- issued_at
- 2026-11-10T09:14:07Z
- engine
- agentgate-policy/2.0.0
- ruleset
- sha256:4c1e…a9f0
- commitment
- sha256:91ab…77c2
- evaluated
- 50 rules · 8 gates
- findings
- G7-NO-RECOURSE ×1
- checks_root
- sha256:0be3…5d14
- prev
- sha256:93c5…6398
sha256:a41f…c3c9Ed25519 · kid 3f9a2c41
05Human in the loop
Some outputs shouldn't be decided by software.
A review verdict holds the message instead of guessing. A named person approves or rejects it with a written justification, and that decision is kept with the validation it belongs to.
held
The gate asks for a person
The response names the rule that wants a human and why.
"verdict": "review",
"findings": [{
"rule": "G5-BINDING-COMMITMENT",
"action": "review"
}]
decided
A reviewer signs off
Request an override with a justification; a reviewer approves or rejects it.
POST /v1/overrides
{ "validation_id": "val_8f2c…",
"gate_id": "G5",
"justification": "Refund approved
under returns policy 4.2" }
recorded
The decision is on file
Who decided, when and why is stored against the validation. A request nobody reviews expires after 90 days. Webhooks tell your systems.
override.requested override.approved override.rejected → HMAC-signed webhook
06Honest scope
What it is — and what it isn't.
it is
- A deterministic check that runs before an output or action ships.
- A published rulebook, with the provision each rule supports cited next to it.
- A hold-for-a-human step with a recorded decision.
- A signed, chained record of each check, verifiable offline with a published key.
it isn't
- A model that understands meaning. Rules match patterns — a subtly wrong answer will pass.
- A prompt-injection firewall. It flags injection artifacts in outputs; it does not inspect your inputs.
- A certification. Passing a check does not make a system compliant with any law.
- A substitute for counsel. The mappings are engineering aids, not legal advice.
| AgentGate | Model-based guardrails | Governance platforms | Evidence proxies | |
|---|---|---|---|---|
| Decides with | Published deterministic rules | A second model | Policies and questionnaires | Nothing — records only |
| Same input, same verdict | Always | Not guaranteed | — | — |
| Catches meaning-level errors | No | Often | No | No |
| Finding mapped to a provision | 47 of 50 rules | Rarely | At policy level | No |
| Hold for a human, on the record | Built in | Varies | Workflow tools | No |
| Verifiable record per decision | Signed, chained receipt | Logs | Reports | Yes |
These work together. Use a model-based filter for meaning, and AgentGate for the things you have to be able to prove.
07Where it fits
For agents that talk to customers and move things.
Lending and insurance
A decline with no reason or no route to appeal is held before the applicant sees it.
G7-DECISION-NO-REASONG7-NO-RECOURSEG8-PROTECTED-GROUND
Wealth and payments
Guaranteed returns are blocked. Transfers above your threshold wait for approval.
G6-GUARANTEED-RETURNG4-MONEY-MOVEMENTG6-AML-EVASION
Coding and ops agents
Tokens, connection strings and destructive commands are stopped before anyone pastes them.
G2-API-TOKENG2-CONNECTION-STRINGG1-DESTRUCTIVE-CMD
08Central Asia
Rules that read Russian and Uzbek.
Most output filters are built for English. AgentGate ships patterns for the languages your customers write in and the identifiers your systems hold.
Ваша заявка на кредит отклонена. Решение принято автоматически, без участия человека.
reviewG8-AUTOMATED-DECISIONG7-DECISION-NO-REASONG7-NO-RECOURSE
- 28 rulescarry Russian patterns; 7 carry Uzbek.
- PINFLUzbekistan's 14-digit personal ID is detected and redacted, with a birth-date check to cut false positives.
- 8600 · 9860UzCard and Humo numbers are Luhn-checked like any other card.
- ZRU-1115Outputs announcing an AI-only decision are held for a person: Art. 7¹ of the Informatization Law bars legally significant decisions from resting solely on AI.
- Law 230-VIIIKazakhstan's duty to tell users they are dealing with AI maps to the same check as EU Art. 50.
09Pricing
Start free. Pay when it matters.
Billed per validation, not per seat. The free tier is large enough to run a real pilot.
Free
$0
10,000 validations a month. Every rule, signed receipts, the verifier.
Developer
$49 / month
100,000 validations. Webhooks and a higher rate limit.
Team
$299 / month
1,000,000 validations. Audit packages per framework, priority support.
Enterprise
Custom
Higher volume, custom rule packs, deployment in your environment.
10Questions
Asked before signing up
Does passing a check mean we're compliant?
No. A rule passing means a specific pattern was not found in a specific output. Compliance is a property of your whole system and how you run it. AgentGate gives you a control that runs on every output and a record that it ran — which is usually the part that is missing — but it is evidence tooling, not a certificate and not legal advice.
Why rules instead of a model?
Because a verdict you cannot reproduce is hard to defend. The same text and the same ruleset always give the same result, the rule that fired is named, and anyone can re-run it. The price is that rules do not understand meaning: they will miss a politely worded mistake. If you need that, run a model-based filter alongside — the two do different jobs.
What do you store?
Receipts, usage counts and your account details. The text you send is checked in memory and is not written to disk; a receipt holds a salted commitment to the text, never the text or a plain hash of it. The playground on this page goes further: it runs entirely in your browser and sends nothing.
How fast is it?
The engine evaluates a typical reply in well under a millisecond — the playground above shows the measured time on your own device. Through the API you add hashing, signing and the network round trip. There is no model inference anywhere in the path.
Can I change the rules?
Per request, you can switch off any rule or gate, change a rule's action (for example, redact instead of block), set the approval threshold for money movement and mark a decision as already human-reviewed. The receipt records what was disabled. Writing your own rules is not self-serve yet — talk to us if you need a custom pack.
Which languages does it read?
Every rule has English patterns. 28 of the 50 also carry Russian patterns and 7 carry Uzbek. Structural detectors — card numbers, IBANs, keys, tokens — are language-independent. The catalogue shows the languages for each rule.
How does an auditor verify a receipt?
Paste it into the verifier. It recomputes the hash and the checks root in the browser, checks the Ed25519 signature against our published key, and asks whether that hash is anchored in the ledger. The format is documented, so the same checks can be run offline with a few lines of code.
Is this a prompt-injection firewall?
No. AgentGate looks at what your agent is about to send or do, not at what users send to it. It will flag the artifacts an injection leaves in an output — "ignore previous instructions", leaked system prompts, data-carrying image links — but input-side defence is a different product.
Ship the agent. Keep the receipts.
A free key and one POST. Your first verified receipt takes about as long as reading this page did.