Gateway

Enforcement before action. The Gateway is the enforcement point of CortexaNet. It screens untrusted content, decides against policy, holds risky actions for a person, and signs a receipt either way.

The problem: direct access vs through CortexaNet

Agents should not access the internet like scripts. A script with your keys can call anything, leak anything, and prove nothing. Direct access means an unknown actor with long lived keys, raw endpoints exposed to the agent, untrusted content executing as instructions, no decision before an action runs, and no evidence after it. Through CortexaNet: registered identity with scoped tokens, single use relay tickets with the raw endpoint redacted, semantic screening as the skill flow directs, a permit, redact, escalate, or forbid decision before anything runs, and a signed receipt for every outcome.

Screening has a taxonomy, not a vibe

Semantic screening returns deterministic labels from a fixed taxonomy. The same content gets the same labels every time, so decisions can be audited and replayed.

• prompt_injection.instruction_override: content that tries to replace the agent's instructions.
• prompt_injection.policy_bypass: content that argues the agent out of following its policy.
• prompt_injection.secret_exfiltration: content that asks the agent to reveal keys, tokens, or other secrets.
• prompt_injection.tool_hijack: content that tries to repoint the agent's tools at a target of its own.
• prompt_injection.hidden_text: instructions hidden in text a person would never see.
• sensitive_data.public_exfiltration: an action that would carry private data to a public destination.
• a2a.destructive_delegation: an agent asking another agent to do something destructive for it.
• a2a.untrusted_tool_request: an agent asking another agent to run a tool it should not trust.
• runtime.self_configuration_change: content that pushes the agent to change its own configuration.

Four effects. No silent failure

Every policy decision resolves to one of four effects. There is no fifth outcome and no silent drop.

• permit: the action proceeds exactly as checked.
• redact: the action proceeds with sensitive fields removed before anything leaves.
• escalate: the action pauses and waits for a person to approve or refuse it.
• forbid: the action is refused and the refusal is recorded.

Risky actions wait for a person

Approval-gated transactions move through PENDING, APPROVAL_REQUIRED, APPROVED, SENT, and COMPLETED. The exits are BLOCKED, FAILED, EXPIRED, and CANCELLED, and each one is recorded. An approval that never arrives is not an approval. Held actions expire and stay undone. The gate fails closed.

One endpoint to start enforcing

POST /v1/agents/{agent_id}/semantic-firewall/check screens an instruction, webpage, email, tool output, document, or agent-to-agent message before the agent trusts it. A blocked check returns effect forbid with the deny layer that produced it. The full live contract, including the exact request and response shapes, is documented for developers at https://cortexa-labs.ai/content/developers.md and in the hosted skill file.

Runtime enforcement (early access)

The hosted Gateway enforces at the API boundary today. The no bypass container runtime, which removes the agent's ability to reach around the Gateway, is in early access with design partners.

Open enforcement, managed network

You should not have to trust the network that governs your agents. The enforcement contract is public: the skill file, the wire protocol, the decision vocabulary, and the receipt format are documented, and receipts verify against a published key from outside the network. CortexaNet Cloud runs the managed side: identity, discovery, relay, and evidence, operated for you. Verification never requires our permission.