SaibleDocs
Gateway

A request, through the gateway

Every request takes the same path. The policy decides the outcome. A record is written on every path, or a gap record states that it was not.

ONE REQUEST, TOP TO BOTTOM01 Keyx-api-key or Bearer40102 Accessapplication lifecycle40303 Stopsemergency stops, every mode40304 Detecttype and position05 Decidesigned policy40306 Rewriteredaction tokens07 Forwardyour provider key08 Recordsigned by the instance09 Deliverto the ledger or your S3Red: refused, in your SDK's error format, and recorded(an unknown key is only counted, not recorded)
Nine steps for every request · red: steps where a request can be refused
  • allowAllowedtextCPR as sentgatewayendpoint Aendpoint B
  • redactRedactedtextCPR-XXXXXX-XXXXgatewayendpoint Aendpoint B
  • routeRoutedtextCPR as sentgatewayendpoint Aendpoint BA is not permitted; B is
  • redact_routeRedacted and routedtextCPR-XXXXXX-XXXXgatewayendpoint Aendpoint BA is not permitted; B is
  • denyRefusedtextCPR as sentgateway403 refusednothing is sent
The five decision outcomes · labels as the ledger shows them
Record onlyrecord_only

Every request is forwarded unchanged to its model's default endpoint, and everything the policy would have done is recorded. Requests under an emergency stop, and requests with an unknown model or key, are refused in every mode.

  • Forwarded unchanged, except for stops
  • Personal data redaction applies
  • Rules route or refuse
  • Emergency stops refuse
  • Each decision recorded
Advisoryadvisory

The rules only record what they would have done. Redaction of personal data still applies before forwarding.

  • Forwarded unchanged, except for stops
  • Personal data redaction applies
  • Rules route or refuse
  • Emergency stops refuse
  • Each decision recorded
Enforceblocking

The rules are applied. A request is redacted, routed or refused as the policy states, and recorded.

  • Forwarded unchanged, except for stops
  • Personal data redaction applies
  • Rules route or refuse
  • Emergency stops refuse
  • Each decision recorded
Three modes, set in the signed policy revision · labels as the console shows them
Steps
  1. 1On Gateways, click Add a gateway and issue its credential.
  2. 2Install the gateway in your network. Each gateway instance should show record-only in Mode.
  3. 3Point one application's SDK at the gateway, with that application's application key as its API key.
  4. 4Send one request. Read the x-saible-decision-id response header.
  5. 5Open /dashboard/decisions/<decision id> to see its decision record.
For your agents

This topic is also documented as Agent Skills that your agents can load: install-gateway-aws, policy, troubleshooting. Request them from Saible.

Next · Gateway · ApplicationsClaude Code, through a gateway →