What it stops, and where that stops.

11 entries, grouped by where the text arrives, because that decides which control can reach it. Each carries the asset at risk, who writes the text that puts it there, what Gate does, and where that ends. Every entry is a fact from the threat model that ships with the binary. Where this page and that one disagree, this page is the one that changes.

In the content

Text a person, a record or a tool's reply put into the request. The detectors read it inside the process holding the connection, before the provider sees it.

Personal data leaves

asset: a customer's identifiers
who writes it: your users, your records, a tool's reply
where it arrives: request body, response stream

Pattern and model detectors, seven operators, and restore lists for the tools Gate dials.

limitThe shapes it knows. No paraphrase, no encoding, no coreference.

Prompt injection

asset: the instructions the assistant follows
who writes it: an outsider, in a user turn or in a page a tool fetched
where it arrives: user and tool_result segments, by default

A classifier or an LLM judge, denying or annotating, run in shadow until the false-positive rate has been read.

limitReduces and does not prevent. A judge reads exactly the text the attacker wrote.

A guard blind in your language

asset: the deny rule's false-positive rate
who writes it: ordinary customers, in a script the checkpoint never saw
where it arrives: every inspected segment

Invariance measured across ten languages before a checkpoint is pinned.

limitArabic recall is unmeasured beyond eight turns, and most languages are unrun.

A secret in the prompt

asset: API keys and tokens
who writes it: your users, pasting
where it arrives: body; header and query when named

19 credential recognizers, on by default. Headers and the query string are inspectable and deliberately read-only.

limitA placeholder wearing a key's shape matches. A format nobody published does not.

At the tool call

The model wrote this text, prompted by whatever it read on the way. The rule runs at the hop the call leaves by, before anything is dialled.

A tool call the agent should not make

asset: what a tool does with the argument it is handed
who writes it: the model, acting on text it was given
where it arrives: tool name and arguments at the MCP hop; message parts at the A2A hop

An access rule at that hop over the caller and the call, and guardrails over the arguments and the result.

limitA tool Gate does not dial. An agent that reaches a server directly is ungoverned.

An upstream that sees the gateway and never the person

asset: the upstream's own idea of what each person may read
who writes it: the caller, under a token their identity provider issued
where it arrives: the credential Gate sends at the MCP hop

Token exchange with the issuer, so the upstream is handed a token minted for that person and that target.

limitMCP servers only, one hop, and no chain of agents acting for each other.

A server nobody approved

asset: which servers agents connect to
who writes it: a team, publishing
where it arrives: the registry a host takes a URL for

Gate serves the registry, and every connect URL in it is Gate's own door.

limitNot a package index. A package a host installs and runs itself has no endpoint to put policy in front of.

On the route

No text arrives here. What is at risk is what the deployment was measured with, when the endpoint that answers preserves less than the one that was measured. The decision is made during resolution, before the request is forwarded.

A route that quietly preserves less

asset: the behaviour you validated, and the capabilities it rested on
who writes it: no one writes it; a translated path, a failover candidate, a pool member
where it arrives: resolution, before the request leaves

Passthrough whenever a provider speaks the request's dialect. A translation that would drop a capability the request uses is refused by default, and every downgrade is counted.

limitNo claim about a vendor's compatibility endpoint. It is passed the bytes, and what it keeps is in the vendor's documentation.

On the account

No text arrives here. What is at risk is the provider account Gate holds credentials for, and the claim that every call on it went through Gate.

Traffic around the gateway

asset: the claim that everything goes through it
who writes it: a colleague with the same key, a key minted in the same organisation
where it arrives: the provider's account, outside Gate

A second ledger from the provider's usage API, judged against Gate's own per day and per token class.

limitProviders that publish a usage API, daily, with no attribution to a key, a model or a route. Nothing in a browser.

Credential sprawl

asset: the provider's API key
who writes it: your own clients
where it arrives: client configuration

Clients hold Gate-issued keys. The provider key is swapped in after every mutation and never sent downstream.

limitA client that still holds the provider key can keep using it. The swap protects the clients that came through the door.

Unbounded spend

asset: the bill
who writes it: your own clients, concurrently
where it arrives: every forwarded request

Cost is reserved before the request is forwarded and settled against real usage after it.

limitA hold is taken per gateway. Spend on the same provider key outside it is neither reserved nor settled.

What it does not defend against

Checked by the build against the threat model: a limit named here that the threat model no longer names, or one it names that is missing here, fails the build.

A determined exfiltrator. Pattern detection finds structured data in the shapes it knows. Paraphrase, base64, an unusual encoding or a description of a secret pass. These guardrails stop accidents and produce evidence. An adversary with time is a different problem.
Prompt injection and jailbreaks. Two detectors cover them and both reduce the risk without preventing it. A classifier catches the phrasings it was trained on and fires on prose about security. A judge reads exactly the text the attacker wrote, and a model that follows instructions can be told what to answer.
Anything the gateway never sees. Traffic on the same provider key that does not traverse Gate is ungoverned. Reconciliation exists to detect that, on providers that publish a usage API. Nothing prevents it.
A compromised gateway host. Provider credentials are in memory. A host with an attacker on it is over.
Whoever can write the configuration. Policy, roles and rules are file-owned, so whoever can change that file, or restart the process against a different one, holds the highest privilege in the deployment. There is no built-in super-admin, because it would be a second escape beside that one.
Whoever holds the cluster secret. The nodes talk over mutual TLS under a certificate authority derived from the cluster secret. A holder of the secret can mint a certificate for any node name, join the cluster, and read every replicated document that is not sealed.
Whoever holds the unsealing material. The cluster secret, and any key-encryption file wrapping a key, decrypt everything the barrier sealed. No policy in Gate constrains them.
A stolen Kubernetes credential in the operator's pod. The operator and the InferencePool controller are the only components holding one. The grant is get on a Credential's Secret in the watched namespaces, with no list, patch, watch or delete. That bounds what the credential reaches and leaves the exposure in place.
Model output correctness. Not a security control and not claimed as one.
Bodies it could not read. Over max_body_bytes, unparseable, or a response whose content type is neither JSON nor SSE. Each is counted in kirto_gate_guardrail_uninspected_total, never assumed clean. Alert on it.
Entities split across frames of an unknown streaming API. On a route the segmenter has no dialect for, each SSE frame is read on its own. A match spanning two frames is missed. Assembling them would invent entities spanning two unrelated messages, which is the worse error.

What is never written down

Prompt content is not retained. The threat model gives four ways to check that claim: what no log statement carries, what traces omit, what the store schema has no column for, and what explanation traces keep. It also names the two exceptions. See Prompt content is not retained.

The full model

The threat model has the assets table, the trust boundaries in configuration, the failure behaviour of every detector and every rule, and what each deployment shape changes. For a vendor security review, the threat model disclosure arranges the same facts as trust boundaries, a STRIDE map and residual risk. Deployment requirements says what the process needs and what it refuses to start without.