Three things an agent needs
Think of an AI agent as a new hire. To do anything useful it needs to think, to act, and now and then to ask a specialist. aigw sits in front of all three, so each one goes through a single place that knows who is asking.
Models do the thinking, tools do the doing, and other agents are who you call when a job needs a specialist. Three different directions, three different problems.
Left to their own devices, apps wire straight to each of these and hold the keys themselves. aigw changes one thing: it all goes through a door that checks who's calling, decides what they're allowed to do, and writes down what happened.
The one idea
The whole trick is having one place where the rules live, instead of trusting a hundred separate apps to each get it right.
With or without a gateway
Two ways to connect two apps to two providers. On top, each app wires itself straight through and holds its own keys. Below, everything meets at one door. Same job, very different day two.
Wired direct, every app holds the keys, so one leak means rotating all of them. Nothing caps spend, so a stuck loop runs all night before anyone notices. Nothing gets written down, so when something breaks the trail is already cold. And teams quietly add their own providers you only hear about later, usually from a bill.
Through the door, the keys sit in one vault the apps never touch, every call is checked and priced, and there's a single log for the lot. The apps got simpler, not harder.
In a sentence
The first way is the company card, photocopied for everyone, with no statement at the end of the month.
One door to the models
Point the apps at aigw instead of at the providers. The real keys live in one vault, and the apps never touch them.
aigw forwards each request on its own account. On the way through it checks the budget, strips anything sensitive out of the prompt, holds the line on which models are allowed, and prices the call so it all lands on one bill.
Rotate a provider key once, here, and not a single app has to change.
Closer to
A travel desk than a credit card. You ask for the trip; they book it, on account, within policy, and you never hold the card.
Giving an agent hands
A model can reason, but to do anything it needs tools: read a record, open a page, file a ticket. MCP is the standard socket those tools plug into. aigw governs the socket.
Two things happen at the door. When the agent asks what it can use, aigw hands back only the tools that caller is allowed, so it never even learns the rest exist.
When it goes to use one, aigw checks the caller's role, looks at the arguments, can pause for a person to approve, then forwards the call using the tool's own credentials, not the agent's.
Closer to
A tool room with a badge reader. You see the drawers you are cleared for, the dangerous kit needs a signature, and every checkout has your name on it.
Handing work to another agent
Sometimes an agent is better off passing a piece of the job to a specialist. Left alone, any agent could call any other. aigw decides who is allowed to.
The handoff routes through the door. aigw confirms this caller may delegate to that agent, keeps the task inside the lines, and records the whole chain rather than only the last hop.
So a general chat agent can't quietly drive the one that moves money.
Closer to
A switchboard. You do not cold-call a department. The operator connects the calls that are allowed, and logs them.
Who is on the other end
Three kinds of caller use the door, and each proves itself differently. aigw turns all of them into the same thing: a name, and the groups it belongs to.
A person signs in with the company login, and their directory groups come along for the ride. An agent carries a virtual key minted just for it, tagged with its team and its purpose. A background service carries a key too, with no person attached.
Whichever it is, the rules and the log end up speaking the same language: this subject, in these groups, did this.
Closer to
A badge, a PIN, or a scanned tag on a robot. The door log reads the same either way.
All of it at once
A person asks an agent to do something real. The agent leans on aigw for everything: it picks a model, calls a few tools, hands a piece to a specialist. Every step is checked against the same identity, and the whole run is one trail.
One door for thinking, doing, and delegating. One identity deciding what is allowed. One log that can answer, afterwards, who did what, with which model or tool, at what cost, and whether it was permitted.
The whole thing
aigw is the guarded front door between your people and agents on one side, and the models, tools, and other agents on the other.
A worked example: the support desk
Almost anyone will recognise this shape. A support team runs an agent to work through tickets. It needs tools, but not everyone should be able to do everything. One server and a handful of rules turn the policy you already keep on paper into something enforced.
Read the table across each row: for that tool, here is what each role can actually do.
| Tool | Front-line support | Senior support | Analyst |
|---|---|---|---|
| Search tickets | Can use | Can use | Can use |
| Look up a customer | Can use | Can use | Not shown |
| Run a report | Not shown | Not shown | Read only |
| Issue a refund | Not shown | With approval | Not shown |
- Can use the tool is available to that role.
- Not shown filtered out of the list, so the role never sees it exists.
- Read only queries that read go through; anything that writes is blocked.
- With approval allowed, but held until a person signs off.
Closed on arrival
The day the server is added, nothing runs. A tool works only once someone grants it. It starts closed, not open.
The right tools, and only those
The front-line role gets the two read tools. The refund tool is not greyed out for it, it is absent from the list. You cannot misuse what you cannot see.
The argument matters, not just the name
The analyst may run reports, but only to read. A query that reads goes through; DELETE FROM customers is stopped before it reaches the database.
A person on the dangerous one
Senior staff can issue a refund, but it does not fire on its own. The call waits for a manager. No approval, no refund.
The log names the person
Not a shared key. The record reads: senior support issued a fifty dollar refund to a named customer, approved by the duty manager.
Every control here maps to a rule the business already lives by: least privilege, a second pair of eyes on money, read-only on the analytics database. Change the nouns and it's the coding agent, or finance, or IT. The pattern does not.