Enterprise-Grade Autonomy: The Agent Gateway Security Model

Contained by Construction

The hard part of agentic commerce was never getting a model to decide to launch a campaign. It was being able to sleep at night after you let it.

An autonomous operator that touches real ad budgets, real customer lists and a live storefront is only an asset if it is contained by construction — not by hoping the prompt holds.

The PlatformDTC Agent Gateway is live in production, and with it the control plane that makes autonomy safe to ship.

Four Gates, Every Call

Authority is granted in layers, and a request must clear all of them. No single leak — a stolen key, a confused agent, a misconfigured host — is enough to do damage on its own.

• 1) Network

  The agent surface is reachable only from your own infrastructure. An allowlist rejects every other source before a request reaches the application, so a leaked key is useless off your hosts.

• 2) Credential

  Every call carries a scoped service-account key or a first-party token. No anonymous path exists. Keys are admin-minted, hashed at rest, rate-limited, and revocable in a single call.

• 3) Scope

  A key grants only the verbs you choose — reading analytics, sending marketing, publishing a store. An out-of-scope call is rejected before any service runs, and the refusal is recorded.

• 4) Approval

  Money-movement and customer-contact actions can require a human tap. The agent proposes; nothing spends until a person resolves it.

Least Privilege Is the Default, Not the Upgrade

Each agent gets its own key carrying exactly the scopes granted to it. A read-only analyst key cannot create a campaign; a creative key cannot connect an ad account.

An agent can always introspect what it is allowed to do, so it never blindly probes for permissions it does not hold.

The Spend Gate, Demonstrated

The single most important promise of an autonomous operator is that it will not spend money you did not approve. We do not ask anyone to take that on faith.

Mint a key that requires approval, and a spend action parks instead of firing. The call returns a pending job rather than a result, the campaign is not sent, and a human resolves it either way.

That exact sequence — gated key, campaign created, send parked, human denial — is part of the launch verification against live merchant data. The agent proposed a spend; the platform held it; a person decided.

The autonomy dial can then go from co-pilot to full autopilot, and the gate is what makes earning that trust gradual instead of a leap.

Safe by Mechanism, Not by Manners

• Idempotency keys are mandatory on mutations, so a duplicate call never double-charges
• Long operations return a job, giving one surface to poll for every workflow
• Every call is recorded with principal, tool, scopes, status and latency
• Event callbacks are signed, so agents react to what happened instead of polling for it

The full security model is published at platformdtc.com/blog.