Gateweave

Gateweave: the policy control plane for AI coding agents—govern every action with evidence you can defend.

Comment

Inspiration

AI coding agents can move from “helpful” to “high-impact” in a single session: installing dependencies, editing production files, reading configuration, and invoking powerful shell commands. Existing sandbox and approval mechanisms are valuable, but teams also need a portable policy layer that can answer:

  • What was this agent allowed to do?
  • Why was that decision made?
  • Which tools or artifacts were trusted?
  • What can the selected agent surface truly enforce—and what can it not?

We built Gateweave to make those answers deterministic, local, inspectable, and honest.

We were equally motivated by agent supply-chain security. Coding agents do not act alone: they rely on skills, plugins, MCP tools, tool catalogs, manifests, and other third-party artifacts. Those dependencies can expand an agent's capabilities or change after review. We wanted teams to be able to ask not just “what did the agent do?”, but “what did we admit into the agent's supply chain, what evidence supported that decision, and has it drifted since?”

What it does

Gateweave provides:

  • A portable policy engine with deterministic deny > ask > allow precedence.
  • A protected credential baseline that policy authors cannot weaken.
  • Codex-focused policy compilation, version-aware capability reporting, and safe configuration mutation planning.
  • Agent supply-chain security for artifacts such as MCP servers, skills, plugins, and custom tools. The current workflow performs bounded static inspection and prospective admission; it never executes, installs, imports, or dynamically loads the inspected subject.
  • Separate declared, observed, and effective capability views, together with discrepancies and composition-risk evidence. Prospective admission evaluates supplied evidence and an exactly bound request; it does not create a lock or mutate an artifact.
  • Local detached Ed25519 signature verification against a supplied local trust bundle for the signed artifact-review and locking path.
  • Canonical lock verification plus MCP tool-catalog contract-drift monitoring against caller-supplied current evidence. It does not contact an MCP server or treat a missing baseline as trusted.
  • Redacted, after-the-fact observation of a bounded Codex JSON event stream, including direct credential reads, outside-workspace reads, compound-shell control-flow risk, and completed file changes. It does not prevent or run the event.
  • A local React/Next.js Console for workspace configuration, supply-chain inventory, evidence, admission, locks, drift, and recorded activity.
  • A capture-backed three-minute demo showing the product against a realistic payment-platform workspace.

How we built it

The core is written in Go and designed around strict ownership boundaries:

  • The policy kernel owns portable evaluation semantics.
  • The admission layer implements the agent supply-chain security path. Its inspect command reads a bounded local artifact snapshot and deterministic manifest, while admit, lock, and monitor consume separate evidence and canonical request/lock inputs. None of those paths execute an artifact.
  • The Codex adapter translates supported policy rules into version-gated Codex configuration and reports enforcement coverage.
  • The Codex observer ingests a bounded structured session-event stream and replays supported shell, read, and file-change observations through the portable evaluator. Its findings are redacted and detective-only.
  • The Console presents the same local data model for developers and reviewers, separating configuration and supply-chain authoring from session/run evidence.

We also created inert fixtures, conformance tests, end-to-end payment-platform scenarios, Playwright UI validation, and a HyperFrames product demo. The video uses real local Console and CLI captures rather than fabricated screens or terminal output.

Challenges we ran into

The hardest problem was not writing a policy evaluator—it was avoiding false confidence.

Agent supply-chain security presented the same challenge. A dependency can describe capabilities differently from what bounded static inspection observes, and a locked MCP contract can differ from later supplied evidence. We had to preserve these facts separately, make identity and evidence bindings deterministic, and ensure that inspection itself never runs or dynamically loads an untrusted artifact.

During dogfooding with Codex CLI, we found that shell-parser control flow could evade a rule that appeared to be natively enforced. We also confirmed that credential-read protection is not magically enforced by every layer of the agent runtime. Rather than hide these limitations, we made them first-class product data:

  • Unsupported coverage is reported as unsupported.
  • Strict compilation refuses to overstate protection.
  • Coverage reports enumerate known bypass conditions.
  • Observation records suspicious or policy-violating activity even where prevention is unavailable.

We also had to solve practical integration issues: Windows path normalization, safe and reversible Codex configuration changes, deterministic serialization/hashing, redaction of sensitive values, workspace selection, and reliable local UI workflows.

Accomplishments that we're proud of

  • Building a deterministic, offline-first policy kernel with explicit deny > ask > allow precedence and a credential baseline that cannot be weakened by ordinary policy rules.
  • Making Codex support evidence-backed rather than aspirational: policy compilation, target capability reports, safe mutation planning, verification, rollback, and strict refusal where coverage is insufficient.
  • Delivering agent supply-chain security as more than a manifest check. Gateweave statically inspects artifacts, evaluates prospective admission, keeps declared, observed, and effective capabilities distinct, verifies a signed lock path with local Ed25519 trust material, and detects MCP tool-catalog contract drift from supplied evidence.
  • Creating a local product Console that makes workspace authoring, configuration, supply-chain evidence, session decisions, and security findings reviewable in one place.
  • Validating the product through realistic greenfield and brownfield payment platform scenarios, real local UI captures, Playwright flows, and a three-minute evidence-led demo.
  • Choosing to expose enforcement gaps honestly. Known parser-bypass and unsupported-coverage conditions are surfaced in reports and strict mode, instead of being hidden behind a misleading green status.

What we learned

We learned that trustworthy AI-agent security is less about claiming total control and more about maintaining a defensible chain of evidence.

A useful governance product must distinguish:

  1. What policy intends,
  2. What the target can enforce,
  3. What was actually observed, and
  4. What remains a gap.

That distinction became Gateweave’s central design principle. The result is a tool that helps teams govern coding agents today while staying candid about the boundaries of current agent platforms.

What's next for Gateweave

Next, we want to deepen Gateweave from policy compilation into richer mission control for real coding-agent sessions:

  • Expand event observation and replay so teams can investigate agent activity across shell, file, tool, and artifact planes from one evidence model.
  • Extend agent supply-chain security beyond the current local Ed25519 trust bundle and MCP-drift workflow with broader provenance integrations, richer artifact analyzers, and more ecosystem coverage for skills, plugins, and tool catalogs.
  • Add more target adapters while keeping the portable kernel and conformance contract stable.
  • Continue hardening the Codex integration with version/platform qualification, adversarial fixtures, and explicit disclosure of target limitations.
  • Evolve the local Console into a stronger developer and DevOps workflow for workspace onboarding, policy authoring, review, drift triage, and release evidence.
  • Build an open-source community around truthful, testable governance for the agents that increasingly build and operate software.

Built With

Share this project:

Updates