Runtime gateways and token scopes

The authority for the next action

The per-action policy capability asks for an inline decision before an agent uses a resource or calls a tool. The credential capability asks about scoped, short-lived access and downstream secret protection. A token can represent restricted authority without proving that a separate policy decision occurs before each tool action. The two capabilities therefore need different evidence. [keycard-c3-1] [keycard-c4-1]

The design tenets call for time-bounded, audience-specific grants and runtime verification of tool invocations. They also distinguish the reasoning system from the access decision system. This creates a useful evaluation question: when an agent proposes an action within a broadly authorised session, which component decides whether that specific action is still allowed? The answer needs a control point, not just an instruction to the agent. [f1-detail]

The gateway in the execution path

Aembit documents an identity gateway checking access policies for tool interactions and use. Keycard describes per-request policy and a gateway aggregating tool servers with policy on individual calls. These descriptions are relevant because they locate enforcement near the requested operation. The buyer still needs the connector and request route to establish that the proposed action actually reaches that enforcement point. [aembit-c3-1] [keycard-c3-1] [keycard-c8-1]

NewCore describes policy checks at each action before tool execution and gateway enforcement over tool access. It runs alongside the existing identity provider, and pricing is not public. The product’s documented limitation is especially relevant here: direct command-line tool calls bypass the gateway today. A connected-tool control should not be presented as coverage of every route an agent can use. [newcore-c3-1] [newcore-c8-1]

Context at the decision point

The decision can only apply the identity and resource context the implementation supplies. Idira’s managed mode records user and agent attribution on each tool call, while its documented connection modes have different behaviour. The buyer should therefore inspect the selected mode, upstream credential handling and resulting attribution together. A product-level statement does not remove mode-specific differences. [palo-alto-idira-c4-1] [palo-alto-idira-c5-1] [palo-alto-idira-c6-1]

Descope describes runtime context informing access policy and tool protocol authorization, registration and consent. The current record asks buyers to confirm availability in the selected plan. This is an important boundary when comparing technical approaches: a documented control is relevant to the architecture, but entitlement and implementation determine whether it is part of the proposed deployment. [descope-c3-1] [descope-c8-1]

• path: identify where the tool request travels
• identity: identify the agent and any authorising user
• authority: inspect the scope and destination of the grant
• policy: identify the decision before execution
• approval: identify whether a sensitive request waits
• exception: identify paths that do not cross the control

Server access and individual tools

Teleport documents enrollment, proxying and identity-based access to tool servers, together with per-tool audit events. These are useful controls for enrolled infrastructure. A server access decision and a decision about one operation are nevertheless different questions. The demonstration should show the granularity needed by the buyer rather than inferring it from the existence of a proxy or audit entry. [teleport-c3-1] [teleport-c6-1] [teleport-c8-1]

Astrix documents server discovery and monitoring, but per-tool enforcement is not established in the current record. Token Security includes tool protocol coverage in its guardrail scope while leaving per-tool policy mechanics for validation. These boundaries help separate visibility from intervention: observing a reachable tool or its activity does not itself demonstrate that a disallowed call is blocked before execution. [astrix-security-c8-1] [token-security-c8-1]

The approval and revocation alongside scopes

Keycard describes step-up human approval for sensitive actions, and NewCore describes routing sensitive actions for approval before execution. The evaluation should identify what causes that pause and what happens when approval is refused. A token scope can describe permitted authority without establishing the timing or conditions of a human decision. The approval is therefore a separate capability to inspect. [keycard-c7-1] [newcore-c7-1]

The same separation applies to revocation. The design tenets call for short-lived, dynamic and revocable authorization, not merely an eventual expiry. The buyer should ask what stops a request after a relevant change and where that change is checked. The answer may involve more than the token’s original contents, so the assessment should follow the complete path to the resource. [f1-detail]

The availability and a bounded trial

Okta’s cited announcement describes a gateway in the execution path between agent and tool call, enforcing policy and logging interactions at runtime. It describes general availability as planned for the stated quarter, without specifying whether quarters are fiscal or calendar. The announcement is relevant to the architecture discussion, but its planned wording should not be silently converted into a confirmed availability claim. [f2]

The bounded trial should compare a permitted call, a disallowed operation and a route outside the gateway. The evaluator can then state which actions were controlled, what identity context was retained and which exceptions remain. This produces a clearer decision than asking whether token scopes or gateways are better in general: the requirement is for the intended action to meet the necessary controls on its actual route. [f1-detail] [newcore-c8-1]

What readers ask