The Gateway That Keeps AI Agents in Check

"In an agent-first world, the core challenge is no longer about capability,
but about identity, provenance, and secure execution."
-- Dr. Vivian Balakrishnan, Minister for Foreign Affairs, Singapore (AI Engineer Day, 2026)

eyeVesa gives autonomous AI agents cryptographic identity, enforces real-time authorization policies, and produces non-repudiable audit trails -- so enterprises can trust what their agents do.

[See How It Works]   [View on GitHub]

The Problem

When AI agents access production systems, three questions have no good answer:

1. Who is this agent?

API keys can be stolen. JWTs can be leaked. There's no cryptographic proof tying an action to a specific agent identity.

2. Should this be allowed?

Static RBAC doesn't adapt. Either agents get full access (dangerous) or humans approve everything (slow). No middle ground.

3. Can we prove what happened?

When something goes wrong, logs can be tampered with. You need cryptographic proof of who did what, when, and why.

Know Your Agent (KYA)

The same principles banks use for Know Your Customer (KYC), applied to AI agents. The core loop is the same: identify → assess → authorize → monitor → enforce. Just swapped "customer" for "agent."

PTV: Prove-Transform-Verify

Hardware-rooted identity attestation. Agents prove their platform identity, the gateway transforms it into a binding, and any party can verify.

    Prove:
      Agent generates hardware attestation (TPM / Secure Enclave)
      Signs with Ed25519 identity key
      Submits to /v1/ptv/attest

    Transform:
      Gateway verifies TPM signature
      Creates identity binding (attestation + public key + expiry)
      Stores binding in identity_bindings table
      /v1/ptv/bind

    Verify:
      Any party checks binding expiry and signature
      Confirms agent is who it claims to be
      /v1/ptv/verify/{bindingID}
    

Three-step protocol. No shared secrets. No API keys. Cryptographic proof that the agent ran on specific hardware at a specific time.

Core Capabilities

Every agent request passes through decision layers before reaching your production systems.

How It Works

Four layers decide every agent action in milliseconds:

3-Tier Policy Engine

Never blocked on policy. Three fallback layers ensure authorization always returns an answer.

Policy decisions return four fields: allow, requires_hitl, reason, trust_delta. The gateway updates the agent's trust score based on trust_delta after every call.

Human-in-the-Loop

When policy is uncertain, humans decide. And they get notified everywhere.

Approval Flow

    Request enters HITL:
      1. Write to hitl_approvals table (persistent, won't disappear)
      2. Notify primary approver (Slack DM / push notification / webhook)
      3. Start expiry timer (default: 30 minutes)
      4. Start escalation timer (5 min -> secondary -> 15 min -> team channel)

    Minute 0:    Notify primary approver
    Minute 5:    No response? Escalate to secondary approver
    Minute 15:   No response? Escalate to team channel (anyone can approve)
    Minute 30:   No response? EXPIRED (never auto-approve)
                 Trust -= 0.01 for expired approval

    For Layer 4 (escalation):
      Requires 2 separate approvals (e.g., VP Engineering + CTO)
      First approval: marks 1/2 approved, still pending
      Second approval: marks 2/2 approved, request executes
    

Notification Backends

Trust Scoring

Trust is earned, not given. Agents start at 1.0 and adapt based on behavior.

Trust Thresholds:

• >= 0.8 -- Auto-allow for low-risk
• >= 0.5 -- Normal operation, HITL for risky
• >= 0.1 -- Restricted, HITL for everything
• < 0.1 -- BLOCKED, cannot operate

Use Cases

Where autonomous agents meet real consequences.

1. DevOps / SRE -- 3am Incident Response

Agent reads logs.......... [AUTO-ALLOW]
Scales up service......... [AUTO-ALLOW]
Deploys hotfix............ [HITL] -- 1 human tap

4 minutes total. Full audit trail. No 3am pages.

2. Finance / Banking -- Automated Transfers

$50 transfer............. [AUTO-ALLOW]
$300 transfer............ [HITL] -- manager approves
$6,000 transfer.......... [AUTO-DENY]

Hard limits enforced. Cryptographic audit for compliance.

3. Healthcare / Pharma -- PHI Access Control

Query public data........ [AUTO-ALLOW]
Access patient records... [HITL]
Bulk data export......... [AUTO-DENY]

HIPAA compliant. PHI access audit with proofs.

Architecture

Dual-protocol gateway: Rust core proxies to Go control plane for auth, registration, and crypto.

    +-------------------------------------------------------+
    |                     ENTERPRISE                        |
    |                                                       |
    |  +-------------+  +-------------+  +--------------+   |
    |  | K8s Adapter |  |  DB Adapter |  | Slack Adapter |   |
    |  |  (Go :8443) |  |  (Go :8443) |  |  (Go :8443)   |   |
    |  +------+------+  +------+------+  +------+-------+   |
    |         |                 |                |           |
    |         +--------+--------+----------------+           |
    |                  |                                     |
    |                  v                                     |
    |       +----------------------+                        |
    |       |   eyeVesa Gateway    |                        |
    |       |                      |                        |
    |       |  +----------------+ |                        |
    |       |  | Gateway Core   | |                        |
    |       |  | (Rust :9443)   | |                        |
    |       |  | mTLS, proxy,  | |                        |
    |       |  | crypto, MCP    | |                        |
    |       |  +----------------+ |                        |
    |       |                      |                        |
    |       |  +----------------+ |                        |
    |       |  | Control Plane  | |                        |
    |       |  | (Go :8080)     | |                        |
    |       |  | REST, gRPC,    | |                        |
    |       |  | HITL, audit    | |                        |
    |       |  +--------+-------+ |                        |
    |       +----------+----------+                        |
    |                  |                                     |
    |    +-------------+-------------+                     |
    |    |             |             |                     |
    |    v             v             v                     |
    | +----------+ +---------+ +---------+               |
    | |PostgreSQL| |  SPIRE  | |   OPA   |               |
    | |+pgvector | |Identity | | Policy  |               |
    | | :5432    | |:8081/90 | | :8181   |               |
    | +----------+ +---------+ +---------+               |
    |                                                       |
    | +-----------------------------------------------+   |
    | | Agent SDK (Rust)                               |   |
    | | connect() -> discover() -> invoke() -> delegate()|   |
    | +-----------------------------------------------+   |
    +-------------------------------------------------------+
    

Request Flow

From agent action to audit log in 12 steps:

     1. Agent registers            -> POST /v1/agents/register  -> PostgreSQL
     2. Resource registers         -> POST /v1/resources/register -> PostgreSQL
     3. Agent connects via SDK     -> mTLS to Gateway Core (:9443)
     4. Agent discovers tools      -> GET /v1/agents/{id}
     5. Agent invokes a tool       -> Ed25519-signed MCP request
     6. Gateway verifies signature
     7. Gateway checks policy       -> OPA evaluates Rego rules
     8. If HITL required            -> Write to hitl_approvals, notify human
     9. If allowed                  -> Proxy MCP request to Resource Adapter
    10. Result returns              -> Agent gets response + trust score
    11. Audit log written           -> Ed25519-signed entry
    12. Trust score updated         -> +0.01 or -0.05
    

Who Benefits

Agent Delegation

Agents can delegate scoped authority to sub-agents. But not forever, and not without limits.

    Hermes (level 0, trust: 0.92)
      +-- Worker Agent (level 1, delegated by Hermes)
            scope: ["log_search"] only
            max_depth: 1 (cannot delegate further)
            expires: 1 hour

            +-- NOT ALLOWED -- delegation_policy prevents depth > 1
    

API Endpoints

Control Plane (HTTP :8080)

Core Proxy (HTTP/TLS/mTLS :9443)

Gateway Modes

Connect with Hermes Agent

Hermes is a self-improving autonomous AI agent by Nous Research. It features 70+ built-in tools, MCP client/server support, persistent memory, and runs on 20+ messaging platforms. Here's how to connect it to eyeVesa for identity, authorization, and audit.

Install Hermes

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash

Register Hermes as an Agent

curl -X POST http://localhost:8080/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "hermes-ops",
    "owner": "org:devops",
    "capabilities": ["infrastructure_read", "infrastructure_write", "deployment"],
    "allowed_tools": ["k8s_deploy", "k8s_scale", "log_search", "incident_create"],
    "max_budget_usd": 500.0,
    "delegation_policy": "single_level",
    "behavioral_tags": ["production", "sre", "high_autonomy"]
  }'

Configure Hermes MCP to Use Gateway

mcp_servers:
  agentid-gateway:
    url: "http://localhost:9443/v1/mcp"
    headers:
      X-Agent-ID: "YOUR-AGENT-ID"
    tools:
      include: [tools/list, tools/call, resources/list, prompts/list]

Set Environment Variables

EYEVESA_AGENT_ID=your-agent-id-here
EYEVESA_AGENT_NAME=hermes-ops
EYEVESA_AGENT_OWNER=org:devops
EYEVESA_GATEWAY=https://gateway.yourcompany.com:9443
EYEVESA_KEY_PATH=/run/secrets/hermes.key

Two-Layer Security

Decision Flow

    User sends message to Hermes (Telegram/Discord/CLI)
      |
      +-- Hermes LLM reasons about the request
      |
      +-- Is it an enterprise resource? (via eyeVesa Gateway MCP)
            |
            +-- Gateway verifies Ed25519 identity
            |
            +-- Gateway evaluates OPA policy
            |     +-- AUTO-DENY  (trust < 0.1, budget exceeded, never event)
            |     +-- AUTO-ALLOW (trust > 0.8, low-risk, tool in allowed_tools)
            |     +-- HITL       (production deploy, bank transfer > $100)
            |
            +-- Gateway signs audit log entry
            |
            +-- Gateway returns result + trust delta to Hermes
    

[Full Hermes Setup Guide]

CLI

The eyevesa CLI covers agent management, authorization, HITL, and audit from the terminal.

    # Agent operations
    eyevesa agent register --name hermes-ops --owner org:devops --capabilities "read,write" --tools "k8s_deploy,log_search"
    eyevesa agent list
    eyevesa agent get <agent-id>
    eyevesa agent trust <agent-id>

    # Authorization
    eyevesa authorize --agent-id <id> --action read --resource-id <rid>

    # HITL approvals
    eyevesa hitl list
    eyevesa hitl approve <approval-id>
    eyevesa hitl deny <approval-id>

    # Delegation
    eyevesa delegate create --parent <id> --child <id> --scope "log_search" --max-depth 1
    eyevesa delegate list <agent-id>
    eyevesa delegate revoke <delegation-id>

    # Audit
    eyevesa audit --agent-id <id> --limit 50

    # Resources
    eyevesa resource register --name k8s-api --type mcp_server --endpoint https://k8s:8443
    eyevesa resource list
    eyevesa resource get <resource-id>

    # MCP
    eyevesa mcp initialize
    eyevesa mcp tools-list
    

Quick Start

Get running in under 5 minutes.

Start Infrastructure

docker-compose up -d

Start Gateway

# Terminal 1: Gateway core (Rust proxy)
cd gateway/core && cargo run

# Terminal 2: Control plane (Go API)
cd gateway/control-plane && go run cmd/api/main.go

Register an Agent

curl -X POST http://localhost:8080/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name":"hermes-ops","owner":"org:devops",
       "capabilities":["infrastructure_read","deployment"],
       "allowed_tools":["k8s_deploy","log_search"]}'

Verify Services

curl http://localhost:8080/health     # Control plane
curl http://localhost:9443/health     # Gateway core
curl http://localhost:8181/v1/data/agentid/authz/allow  # OPA

© 2026 eyeVesa. Proprietary license.

Developed by Hafizal Johari