Gateways

A Gateway protects one Agent or one MCP provider.

1. Choose what to govern

Select an Agent or MCP provider. GroundForge loads the capabilities discovered for that resource. Example Agent capability list:

get_weather
get_forecast
delete_weather_cache

2. Choose an action

Action	What the user experiences
Allow	The capability runs normally
Observe	The capability runs and the Trace marks it as monitored
Review	The request waits for a person to approve or reject it
Block	The capability does not run and a policy response is returned

For example, allow weather lookups, observe forecasts, and require Review before deleting a cache.

3. Add a clear message

A Block message might be:

This action is restricted by policy.

A Review message might be:

This action needs approval. You will receive the result after it is reviewed.

Avoid exposing internal policy details in user-facing messages.

4. Test the rule

Send a request that selects the capability, then open its Trace. Confirm the action, whether the capability ran, and the final response.

Screenshot placeholder
Add /images/governance/gateway-overview.png showing the selected Agent or MCP, discovered capability rows, actions, reasons, messages, and manifest preview.

See Gateway Rules and Tool governance tutorial.

Overview

Concepts

Examples

Platform

SDK

CLI

REST APIs

Operations

Reference

1. Choose what to govern

2. Choose an action

3. Add a clear message

4. Test the rule

​1. Choose what to govern

​2. Choose an action

​3. Add a clear message

​4. Test the rule

1. Choose what to govern

2. Choose an action

3. Add a clear message

4. Test the rule