Compliance
Meet EU AI Act, GDPR, and SOC2 requirements with full audit trails and policy enforcement on every agent action.
Efficiency
Let agents operate more autonomously. Granular policies replace manual human-in-the-loop approvals.
Governance
Central policy management across all your agents. One place to define, version, and enforce rules.
The problem
AI agents today are treated like human users. They get role-based access — broad permissions tied to an identity. A support agent with a “Support” role can access all customer data, even when it only needs one customer’s record to resolve a ticket. This creates three risks:- Over-provisioned access — agents can reach data and tools far beyond what their current task requires
- No audit trail — you can’t prove which agent accessed what, when, or why
- Policy gaps — compliance rules are hardcoded per agent, making them expensive to maintain and easy to break
The solution
Devctrl introduces Task-Based Access Control (TBAC). Instead of asking “who is this agent?”, Devctrl asks “what is this agent trying to do?” Permissions are:- Scoped to the current task — not the agent’s role
- Granted just-in-time — temporary tokens that expire when the task is done
- Enforced on every call — the gateway evaluates policies before routing to upstream tools
- Fully audited — every allow and deny decision is logged with complete context
How it works
Every request from an AI agent flows through the Devctrl gateway before reaching your tools.Define tasks (Optional)
Define the tasks your agents perform. Each task has a context schema that describes what information it carries.
Attach policies (Optional)
Write CEL-based policy rules that define conditions for allowing or denying tool calls.
Next steps
Quickstart
Go from zero to your first policy-enforced tool call in 15 minutes.
How it works
See the full architecture — how agents, the gateway, and your tools connect.