SaibleDocs
Gateway

A request, through the gateway

Every request takes the same path. The policy decides; the record is written on every path, or a gap record says it was not.

ONE REQUEST, TOP TO BOTTOM01 Keyx-api-key or Bearer40102 Accessthe tool's lifecycle40303 Stopsemergency, every mode40304 Detecttype and position05 Decidesigned policy40306 Rewriteredaction tokens07 Forwardyour provider key08 Recordsigned by the instance09 Shipto the ledger or your S3Red: refused, in your SDK's error shape, and recorded(an unknown key gets no record, only a count)
Nine steps, every request · red: where it can be refused
  • allowAllowedtextCPR as sentgatewayendpoint Aendpoint B
  • redactRedactedtextCPR-XXXXXX-XXXXgatewayendpoint Aendpoint B
  • routeRoutedtextCPR as sentgatewayendpoint Aendpoint BA not allowed for it; B is
  • redact_routeRedacted + routedtextCPR-XXXXXX-XXXXgatewayendpoint Aendpoint BA not allowed for it; B is
  • denyDeniedtextCPR as sentgateway403 refusednothing is sent
The five decisions · the ledger's labels
Record onlyrecord_only

Every request is forwarded unchanged to its model's default endpoint, and everything the policy would have done is recorded. Emergency stops and unknown models or keys are refused in every mode.

  • Forwarded unchanged, stops aside
  • Personal data redaction applies
  • Rules reroute or refuse
  • Emergency stops refuse
  • Each decision recorded
Advisoryadvisory

The rules only record what they would have done; redaction of personal data still applies before sending.

  • Forwarded unchanged, stops aside
  • Personal data redaction applies
  • Rules reroute or refuse
  • Emergency stops refuse
  • Each decision recorded
Enforceblocking

The rules are applied: a request is redacted, rerouted or refused as the policy says, and recorded.

  • Forwarded unchanged, stops aside
  • Personal data redaction applies
  • Rules reroute or refuse
  • Emergency stops refuse
  • Each decision recorded
Three modes, chosen in the signed policy · the console's own words
Do it
  1. 1On Gateways, click Add a gateway and issue its credential.
  2. 2Install the gateway in your network. Each instance should read record-only in Mode.
  3. 3Point one tool's SDK at the gateway, with the tool's Saible key as its API key.
  4. 4Send one request. Read the x-saible-decision-id response header.
  5. 5Open /dashboard/decisions/<decision id> to see its record.
For your agents

This topic is also written as Agent Skills your agents can load: install-gateway-aws, policy, troubleshooting. Ask us for them.

Next · Gateway · LedgerWhat a decision record holds →