> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devctrl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How It Works

> The Devctrl architecture — how agents, the gateway, policies, and your tools connect.

Devctrl sits between your AI agents and the tools they use. Every request passes through the managed gateway, where it's authenticated, authorized against your policies, and logged — before reaching the upstream tool server.

All agents connect to `https://gateway.devctrl.ai/mcp`. You manage your projects, tools, identities, tasks, and policies in the [Devctrl Console](https://console.devctrl.ai).

## Request flow

When an agent makes a tool call, here's what happens:

<Steps>
  <Step title="Authenticate">
    The gateway verifies the bearer token against the identity's credential. If a task token is present in the `X-Task-Token` header, it loads the task session and its context.
  </Step>

  <Step title="Resolve tool">
    The gateway looks up the requested tool to find which upstream MCP server hosts it.
  </Step>

  <Step title="Evaluate policies">
    The policy engine runs your CEL expressions against the request context:

    ```text theme={null}
    {
      "identity": { "name": "...", "labels": { ... } },
      "task":     { "name": "...", "labels": { ... }, "context": { ... } },
      "request":  { "tool": { "name": "...", "args": { ... } } }
    }
    ```

    Deny rules are checked first. If any deny rule matches, the request is blocked. Then allow rules are checked — all must pass. If no active policy release exists, the project's default action (allow or deny) applies.
  </Step>

  <Step title="Proxy to upstream">
    For allowed requests, the gateway forwards the tool call to the upstream MCP server and returns the response to the agent.
  </Step>

  <Step title="Log the result">
    Every decision — allow or deny — is recorded in the audit log with the full context: identity, task, tool, arguments, policy evaluation results, and upstream response.
  </Step>
</Steps>

## Key components

<CardGroup cols={2}>
  <Card title="MCP Gateway" icon="server" href="/concepts/mcp-gateway">
    The managed service that routes MCP requests between agents and tool servers.
  </Card>

  <Card title="Policy Engine" icon="shield-check" href="/concepts/policies">
    Evaluates CEL expressions against every tool call to enforce allow/deny decisions.
  </Card>

  <Card title="Console" icon="browser" href="/console/projects">
    The web interface where you manage projects, identities, tasks, tools, and policies.
  </Card>

  <Card title="Audit Log" icon="list-check" href="/concepts/audit-log">
    Complete record of every agent action — what was requested, what was decided, and why.
  </Card>
</CardGroup>