One client stays one security boundary
Each of your clients gets its own Gateway — an AAG security boundary holding that client’s credentials, permissions, policy and audit history. Nothing is shared between them by default.
How it works
The AI gets capability. You keep custody.
AAG sits on the access path between your team’s AI and your clients’ systems. Every request runs inside exactly one client’s boundary, and leaves a record.
In four steps
What happens when someone asks a question
Choose a client
A person on your team starts a session for one client. The session belongs to that client’s gateway.
Client ACheck before running
The client’s gateway checks the session and the permission for the exact request. Anything else is refused.
AllowedRun behind the boundary
The client’s connector uses the client’s credential to run the request. The AI gets the result, not the credential.
Credential stays putKeep the evidence
The decision is recorded against that client: who acted, what was asked, allowed or refused, and when.
Recorded
Context and control
From an informed question to a reviewed action.
Explore the design concepts behind client context, permitted requests and reviewable answers. Confirm the capabilities for your workflow during pilot scoping.
Illustrated concept
AI that starts with the brief
View full size ↗Bring client goals, brand guidance and definitions together with authorized system data. The diagram shows a client gateway providing that context to an AI application while protecting credentials in the client vault.
The benefits shown are intended outcomes; review generated answers against source data. Confirm the named connectors, AI applications and brief-management features in your pilot scope. Check availability →
Explore the expanded illustration
The expanded view groups client goals, brand guidance and key decisions with authorized system data, then shows potential uses by AI applications and agency workflows.
Expanded design concept. Named providers, real-time data, brief versioning and workflows are not an availability guarantee; confirm each requirement during scoping.
View expanded illustration full size ↗Illustrated concept
AI requests. You decide the limits.
View full size ↗The client policy determines the permitted operation. A workflow can require human approval for a proposed change, while out-of-scope requests are refused. The decision is recorded.
Conceptual approval workflow. Current reviewed connector evidence covers read-only Google Ads operations; write and approval support require separate verification. Review available operations →
Explore a proposed campaign-change approval
Illustrated concept
Approve the exact change
View full size ↗The example compares the current and proposed budget and geography while keeping the bidding strategy unchanged. Approval applies only to the reviewed change.
Synthetic campaign settings, not AAG prices or an available campaign-editing feature. Write operations and approval enforcement must be verified for the chosen connector. Check operation availability →
Illustrated concept
An answer you can trace
View full size ↗A useful answer makes its question, sources and reporting period visible. In this synthetic example, a named campaign is reported as the leading source of qualified leads.
Illustrative answer format, not an actual AAG response. Source references help review an answer; they do not establish its correctness or replace the gateway’s access-decision record. Review audit evidence →
In detail
The full sequence
Show all eight steps
You define a client boundary
Each of your clients becomes an Agency Client with its own Gateway — an AAG security boundary. Nothing crosses between them unless you deliberately make it so.
Credentials go in once, and stay in
A client’s provider credential is submitted through a single-use intake and stored encrypted with a dedicated gateway encryption key. The control plane holds metadata about it, not the secret itself.
A person signs in and gets a session
Your team member authenticates and receives a revocable AAG session bound to one Gateway — one client boundary — and no other.
The AI asks for a capability
The AI does not ask for a credential. It asks to perform a specific operation against a specific client system, under the authority of its session. Gateways speak MCP, the Model Context Protocol.
The client’s gateway authorizes before it executes
The gateway checks permissions and policy against that exact operation. If the session, Gateway and client do not line up, or the policy does not permit it, the request is refused before anything reaches the provider.
Execution happens behind the boundary
A permitted operation runs in that client’s connector executor, which is the only component able to read that client’s credential. The AI receives the result, not the key.
The decision becomes evidence
The time, the client boundary, who acted, the operation, the allow-or-deny decision and the result are recorded in a hash-chained audit record.
You revoke, rotate or offboard when things change
Suspend or destroy a gateway, or rotate or revoke a credential. After committed revocation propagates, subsequent requests are refused; already-admitted requests can finish. The record is kept.
The nine design principles underneath
The AI gets capability, not custody
AI does not receive raw provider credentials. Credential material stays behind the protected execution path; the AI is authorized to perform a specific operation instead of being handed the key that performs it.
Every AI session is bound to exactly one Gateway
An AI Session is issued against a single client boundary. The gateway checks that binding on every request rather than assuming it.
Authorization is checked before execution
Permission and policy are evaluated against the exact intended operation before anything touches a downstream provider — not logged after the fact.
Cross-client access fails closed
A mismatch between session, Gateway and client is a refusal, not a warning. The safe outcome is the default outcome.
Access leaves attributable evidence
Each decision records who or what acted, in which client boundary, which operation, the allow-or-deny outcome, and when.
Lifecycle is part of the product
Suspend, retire and destroy a gateway; rotate or revoke a credential; disable or re-enable a connector. Losing a client is as operationally real as winning one.
The AI runtime can change without redefining security
The security model binds to authenticated AI principals and governed capability execution, not to one model vendor. Switching models does not mean rebuilding your client boundaries.
Blast radius is contained by design
If an AI session is compromised or behaves unexpectedly, it is designed to be limited to one client’s boundary rather than everything the agency can reach.
See it against your own accounts
A pilot runs one real workflow with real credentials, so you can check these properties yourself.