Guardrails & approvals¶
Guardrails decide who may use AI on which apps, and how far it may go. Find them under Admin → Guardrails.
Learning mode first¶
A fresh Gate starts in learning mode: every AI call is allowed and recorded. Let it run for a normal week of work, then press Build rules from the trail. Gate drafts guardrails from what people actually did. Review them and save.
Once you save a policy, nothing is allowed unless a guardrail says so, and an explicit block always wins.
Templates help you start: company baseline and IT operations.
A guardrail reads as a sentence¶
Who may do what in which app.
| Part | Choices |
|---|---|
| Who | A person, group:<name> (from AD or manual groups), or role:admin |
| May | Allow, Block, Needs approval, Break-glass (a reason is required, and logged) |
| Do what | Read only, Read and change, Everything |
| In which app | One of your apps, optionally only this part and except |
An app's actions count as read when the app marks them read-only; everything else counts as a change.
Try it before you save¶
- Try it as a person: pick a person, what they want to do, and the app. Gate says what it would decide right now, including your unsaved changes.
- Dry run: save a policy with Dry run ticked and Gate logs what it would block, but blocks nothing new. The audit trail shows those calls as
dry_run. - Save as new version keeps a version history, with a note on what changed.
Advanced shows the same rules as JSON. Resources look like app://tools/<action>; * stays inside one segment, ** crosses them.
Approvals¶
Actions a guardrail marks Needs approval wait under Approvals. An approver runs them as the person who asked, confirming with their authenticator code. Approval never changes who the action is attributed to.
Data filter¶
What comes back from an app passes through Gate before the model sees it. Gate can redact (or block the whole result for) payment cards, Social Security numbers, API keys and secrets, email addresses and phone numbers. It is deterministic, the audit row counts what was removed, and the values are never stored. Paste a sample result under Try it to test.
Need a policy document too?
The AI acceptable use policy template and the employee handbook section are written to match what Gate enforces. Both download as Word files.