Does customer data pass through Bot Turret?

No. The gateway runs in your VPC and forwards calls to your own tools. We receive signed metadata — IDs, hashes, decisions, policy text. Arguments and responses are hashed and never stored anywhere.

What happens if Bot Turret is down?

Your agents keep running. Decisions come from locally cached policy, records buffer on your disk and sync later, and the kill switch is a local CLI. We are never in the synchronous path.

How much latency does it add?

The controlled two-vCPU benchmark is still pending. Staging measurements will be reported separately and will not be presented as the production target.

Why should an auditor trust your evidence?

They receive the pack, independently supplied trust material, and a standalone verifier. Full acceptance requires a complete chain and valid anchoring proof.

Is this an LLM gateway or a prompt firewall?

No. We govern tool calls, not model input or output. We bound what an agent can do; we don't detect prompt injection. Use us alongside a prompt firewall, not instead of one.

Which agent frameworks work?

Anything that calls tools over MCP or HTTP: LangGraph, Google ADK, OpenAI Agents SDK, raw MCP clients. No agent code changes for the proxy mode.

Can we self-host everything?

The gateway is always self-hosted. A self-hosted ledger is on the roadmap for teams that need the evidence store inside the perimeter too.

What does the design-partner program include?

Free through a pilot of up to six months, weekly working sessions, and we ship what blocks you. You give us a named engineer, one real security questionnaire, and a reference at go-live.

Private pilot · Runs in your VPC

Agents don't have permissions.They have yours.

Bot Turret scopes, contains and approves protected tool calls made by your AI agents — then signs an independently verifiable authorization record.

Apply as a design partner See how it works

Your data never leaves your VPC
Signed with your keys
Verifiable without trusting us

BOT TURRETAUTOMATED COMPLIANCE & SECURE LEDGER FOR AI AGENTS

Loading the interactive operator console…

Sample evidence recordturret_evt_9f31c…

Agent: billing-agent · v4
Tenant: acme-health · t_8Q2R
Tool: postgres.query
Action: invoice.refund
Decision: ALLOWrule pay-002
Policy commit: 9f2c41a · policies/billing.yaml
Approver: r.mehta · gateway
Signature: ed25519:3f9a7c…c1d0

Private pilot in active development. Design-partner applications open.

Your agents have more access than your interns.

Every B2B SaaS company is shipping agents. Then the buyer's security questionnaire arrives: "How do you scope, monitor and revoke your AI agents' access to our data — and can you prove what they did?"

Can't scope

Scoped tokens

Agents inherit broad keys from whoever spawned them. Bot Turret mints a short-lived token per call, bound to one agent, one tenant, one tool and one action.

Can't contain

Tenant walls and a kill switch

Bot Turret denies cross-tenant calls by default and supports local revocation while the hosted control plane is unavailable.

Can't prove

Signed evidence

Logs show what happened, not who allowed it. Every decision is signed with your key, chained, and tied to the exact policy commit in force.

The pain isn't hypothetical risk. It's a seven-figure contract stuck in security review, today.

Apply as a design partnerFree through pilot, no card.

policies/billing.yaml

# Deny by default. Every allow cites a rule id.
rules:
  - id: pay-001
    tool: postgres.query
    action: invoice.read
    effect: ALLOW
    action_class: low
  - id: pay-002
    tool: postgres.query
    action: invoice.refund
    effect: ALLOW
    action_class: high
    require_approval: true
    max_amount_minor: 500000

gateway host

# Works offline, from the gateway host.
turret revoke --kind agent --id billing-agent

# Or the whole fleet at once.
turret revoke --kind fleet --id pilot

tool call · 202 Accepted

{
  "decision": "REQUIRE_APPROVAL",
  "status": "pending",
  "approval_id": "7c1e0b94…a2ec6d",
  "request_hash": "459d0099e5…7d9196"
}

records.jsonl · record 32

{
  "seq": 32,
  "type": "execution_authorized",
  "agent_id": "billing-agent",
  "tenant_id": "acme-health",
  "tool": "postgres.query",
  "action": "invoice.refund",
  "decision": "ALLOW",
  "rule_id": "pay-002",
  "policy_commit": "9f2c41a",
  "prev_hash": "beac56a2fb…368076",
  "hash": "4ee55aa103…b7795f",
  "signature": "ed25519:3f9a7c…c1d0"
}

auditor laptop · offline

# One pack per customer, per period.
turret verify --trust trust.json --pack acme-health-2026-08.zip

How it works

01
Point agents at the gateway.
One container in your VPC. No agent code changes.
02
Write policy in git.
YAML rules per agent, tenant and tool. Every decision cites the commit.
03
Export the receipt.
Signed evidence pack per customer, per period. Auditor verifies without trusting us.

The pilot acceptance target is a first signed record within 30 minutes of a clean installation.

Policy enforcement: Local
Authorization records: Signed
Evidence verification: Offline
Maximum signed policy validity: 7 days

“We are building Bot Turret because agents that touch records, invoices and operational tools need a policy boundary that can prove who authorized each protected action.”

A team of dentists and engineers

Enforced in your VPC. Evidenced in ours.

The gateway decides locally from cached policy; no round-trip to us per call.
Only signed governance metadata ships asynchronously; raw tool arguments and responses are excluded from Bot Turret persistence.
Approval previews remain at the customer gateway.

Architecturally unable to take your agents down.

Policy cached with a 24-hour TTL and a 7-day hard stop.
Records buffer on your disk and sync later; gaps are signed, never silent.
New authorization stops when the signed policy expires.

“Trust us” is not an audit trail.

Records are canonical JSON, SHA-256 chained, Ed25519 signed with a key that never leaves you.
Full acceptance requires a complete anchored pack and independently supplied trust material.
turret verify checks an exported pack without a network connection.

Works with the agents and tools you already run

The current pilot protects configured Streamable HTTP MCP and HTTP/OpenAPI backends.

Model Context Protocol(2026-07-28 spec)
Streamable HTTP MCP
REST / OpenAPI
PostgreSQL hosted ledger
Cerbos policy evaluation
Microsoft and Google identity
Git-versioned policy bundles
Sigstore

Pilot scope and commercial terms are agreed directly.

Pilot

Contact us

Scoped implementation

Synthetic protected tools
Customer-side gateway approvals
Signed evidence export
Microsoft and Google sign-in

Apply as a design partner

Team

Contact us

Based on governed agents and tenants

Multi-tenant boundaries
Approval gates and kill switch
1-year signed retention
Gateway-hosted approvals

Apply as a design partner

Compliance

Contact us

Evidence and retention scope reviewed

Everything in Team
Tenant-specific evidence packs
Offline verification material
Retention requirements review
Identity and role configuration

Talk to us

Pricing will be finalized after the pilot scope, governed agents and tenant count are understood.

Private pilot · Customer-side approvals · Raw tool payloads excluded from governance persistence

Questions the security team asks

Does customer data pass through Bot Turret?: No. The gateway runs in your VPC and forwards calls to your own tools. We receive signed metadata — IDs, hashes, decisions, policy text. Arguments and responses are hashed and never stored anywhere.

What happens if Bot Turret is down?: Your agents keep running. Decisions come from locally cached policy, records buffer on your disk and sync later, and the kill switch is a local CLI. We are never in the synchronous path.

How much latency does it add?: The controlled two-vCPU benchmark is still pending. Staging measurements will be reported separately and will not be presented as the production target.

Why should an auditor trust your evidence?: They receive the pack, independently supplied trust material, and a standalone verifier. Full acceptance requires a complete chain and valid anchoring proof.

Is this an LLM gateway or a prompt firewall?: No. We govern tool calls, not model input or output. We bound what an agent can do; we don't detect prompt injection. Use us alongside a prompt firewall, not instead of one.

Which agent frameworks work?: Anything that calls tools over MCP or HTTP: LangGraph, Google ADK, OpenAI Agents SDK, raw MCP clients. No agent code changes for the proxy mode.

Can we self-host everything?: The gateway is always self-hosted. A self-hosted ledger is on the roadmap for teams that need the evidence store inside the perimeter too.

What does the design-partner program include?: Free through a pilot of up to six months, weekly working sessions, and we ship what blocks you. You give us a named engineer, one real security questionnaire, and a reference at go-live.

Prove every agent action.

Three seats. Free through pilot. Your data stays home.

Read how verification works

Agents don't have permissions.They have yours.They have yours.

Your agents have more access than your interns.

Scoped tokens

Tenant walls and a kill switch

Signed evidence

How it works

Point agents at the gateway.

Write policy in git.

Export the receipt.

Enforced in your VPC. Evidenced in ours.

Architecturally unable to take your agents down.

“Trust us” is not an audit trail.

Works with the agents and tools you already run

Pilot

Team

Compliance

Questions the security team asks

Prove every agent action.

Agents don't have permissions.They have yours.