5
modules available in early access today, and three more coming soon
The Platform
One control plane. Every agent, every call.
StartiQOS sits between your agents and their model. Every tool call the model requests, whether to your APIs, databases or apps, is checked against the authority that agent actually holds before your agent can run it. Each check takes under 0.05 ms at the 99th percentile in our tests, and every decision is recorded with its reason.
In one sentence: an agent control plane is a single layer that decides, for every action an AI agent attempts, whether that agent may take it, and keeps a record of the answer.
Where it sits
Your agent
n8n, LangGraph, CrewAI or custom
Sends every model call to the gateway.
StartiQOS control plane
For each tool call the model requests
- Verify the delegation chain
- Check the capability against policy
- Evaluate the combined reach
- Apply the taint bound
AllowEscalateDeny
Model provider
Your provider key stays in the control plane.
Attestation ledger
Hash-chained, with signed seals.
One configuration line. Point your agent’s model base URL at the gateway. No agent code changes, no change to your prompts, and no extra model round trip.
Modules
Five in early access. Three coming soon.
Each module is a part of the same gateway. Early-access partners help decide which of the coming-soon modules we build first.
Early access
Runtime Gateway
Every tool call is checked before it runs.
- Nine checks on every call, in a fixed order
- Learn, shadow, then enforce, only after a person approves
- Provider keys stay inside the gateway
Coming nextEvidence export for auditors
Early access
Agent Access Control Panel
See every agent and decide what it may do.
- An eight-screen console: overview, agents, escalations, policies, activity, usage, audit, settings
- Allow once, add to policy, or deny a paused action
- One kill switch for all agents
Coming nextPer-agent grant and revoke, an agent registry with owners, SSO and team roles
Early access
Policy Engine
Access based on what each agent actually needs.
- Least-privilege policies learned per task and approved by a person
- Poisoning-resistant learning
- A global deny list for shell and code execution
Coming nextOrganization rules and role templates based on responsibilities
Early access
Agent Observability and Health
Know what your agents are doing, and whether they are healthy.
- A live view of agents and decisions
- Health and readiness checks, Prometheus metrics
- Latency and model-health tracking
Coming nextDepartment and team views, alerts to Slack, email or webhook, multiple organizations
Early access
Token and Cost Control
Track spend and ride out provider limits.
- Token and cost tracking for each agent
- Automatic switch to a backup model when a provider fails
- Throttling before rate limits are hit
Coming nextBudgets with an automatic stop, alerts, caching, cheaper models for simple steps
Coming soon
MCP and Computer‑Use Guard
Control what agents do through MCP servers, browsers and desktops.
- Agents see only the MCP tools their policy allows
- The same checks on every MCP call
- Approved-site lists, and a person approves payments, messages, deletions and downloads
ScopeCovers actions that pass through StartiQOS
Coming soon
Agent Speed Optimization
Find what slows your agents down.
- Timing for each agent step
- Detection of slow tools and models
- Caching of repeated calls
Coming soon
Agent Playground
Let agents fight it out in the ring before they touch real systems.
- A sandbox with test tools
- Attack scenarios, to see what an agent tries to do
- A report and a draft least-privilege policy at the end
Early access: everything listed under “Available today” works and has been tested in our own environment. Items under “Coming next” and “Planned” are not yet available.
Inside the Gateway
Six layers of protection.
Each layer answers a question the others cannot. Together they define what an agent is permitted to do.
01
Learned Least-Privilege
Hand-written policies struggle to keep up with agents whose tools keep changing. For each task an agent performs, we observe real runs, identify the capabilities the task genuinely needs, and draft a minimal policy. A named person approves it before it takes effect.
02
Composition & Reachability Analysis
Permissions are checked in combination, not one at a time. We calculate the combined reach of an agent’s capabilities and block combinations that would move sensitive data outside or run code with outside reach, even when each permission was granted on its own.
03
Monotonic Delegation
When one agent hands work to another, the delegated authority must be equal to or narrower than the parent’s. Authority can shrink down a chain. It can never grow.
04
Provenance & Taint Tracking
We track where an agent’s context came from. Once it has read untrusted material, capabilities that require a clean context stop being valid. Exposure narrows authority automatically.
05
Poisoning-Resistant Policy Learning
An attacker who floods the learning window with fake activity should not be able to widen a policy. Each capability counts once per session, behaviour after untrusted input counts for less, and unusually busy sessions are discarded.
06
Runtime Verification
At the moment of each call, nine checks run in a fixed order. The answer is allow, escalate to a person, or deny, with the reason recorded in a tamper-evident ledger.
Deployment and Security
It runs inside your environment.
Your traces, policies and keys stay with you. We have no inbound connection to the gateway.
Self-hosted
One command to set up
A Docker container in your own infrastructure. The setup script asks for your model provider key, generates every other key, starts the gateway and prints the base URL to paste into your agent.
Your provider key stays inside. Agents get a gateway key; the gateway adds the provider key itself, so an agent that tries to go around it has no key to use.
Data
Shapes, not contents
Traces record the shape of each request, such as which tool was called and the types of its arguments, never the argument values.
By construction. The values are never written, so there is nothing sensitive to leak from the record.
Hardening
The gateway is a target too
API keys on every call, strict limits on request size, signed policy files, replay protection, per-agent rate limits, and a container that runs as non-root on a read-only file system.
No text is parsed to make a decision, so a prompt injection has nothing to persuade.
Failure Behaviour
Recording may degrade. Deciding may not.
Every failure has a response decided in advance.
01
The model provider is down
The router tries the next model in your chain. If none is available, the request fails. Decisions are unaffected.
02
A policy file is damaged
The previous policy stays in memory. A damaged file never replaces a good one.
03
A trace or ledger write fails
Recording degrades and an alert is raised. The decision is not affected.
04
The gateway hits an internal error
It never allows. In fail-closed mode it denies; in fail-open mode it pauses the call for a person.
Stated Limits
What it does not do.
We publish the boundaries so you can plan around them.
01
It governs tool calls, not prose
A model that writes harmful instructions in plain text, without calling a tool, is outside its scope.
02
A runtime with its own shell can go around it
If your agent runtime can run local commands without the model path, those actions never reach the gateway. Run the runtime in a sandbox.
03
MCP and desktop control are coming soon
Today StartiQOS governs the tool calls that pass through the model path. MCP interception and browser or desktop controls are on the roadmap.
Questions
Platform questions, answered plainly.
A single layer that decides, for every action an AI agent attempts, whether that agent may take it, and records the answer. StartiQOS makes that decision at runtime, before the action runs.
Filters try to recognise a bad instruction. StartiQOS removes the access the instruction would need. If a permission was never granted, no wording can invoke it.
Yes. Any agent that calls an OpenAI-compatible model API can point its base URL at the gateway. n8n, LangGraph, CrewAI, Flowise and custom clients work this way today.
OWASP lists Excessive Agency among the top risks for LLM applications: an agent granted more permissions or reach than its task requires. StartiQOS limits each agent to what its task has been observed to need, and checks that on every call.
Gartner describes guardian agents as systems that supervise AI agents so their actions stay within goals and boundaries, and notes that some are built as gateways. StartiQOS is a gateway of that kind. It does not use a model to judge actions; it applies approved rules and records every decision.
Find out what your agents
are actually allowed to do.
Early access starts with a two-week shadow-mode pilot. Nothing is blocked. You get the gap between the access each agent holds and the access it uses, and every combination that could move data out.