Govern the AI your
people / and agents use.
See every AI app, agent and MCP server in use, decide what reaches the model and every tool call, and trace each action to the person behind it. All without replacing your identity provider, your AI clients or the gateways you run.
Discovery and recording start in monitor mode. Blocking is switched on policy by policy, when the data says it's safe.
AI already acts for your people. Security can't see it, stop it or trace it.
You can't see it, you can't stop it in time, and you can't say who did it. People sign up for AI tools with corporate accounts, connect MCP servers and grant OAuth consents, and little of it shows up in the identity provider. A prompt carrying a confidential file, or a tool call that writes to production, has already happened by the time anyone reads a log. And that log shows the agent or a shared key, not the person it acted for. SlashID closes all three from one identity graph.
Four control points, one identity graph.
Where people use AI on the web
Sign-ins, sessions and OAuth consents on any site. Deny or warn on AI sites you haven't approved.
On every model call, server side
Before the model runs, block prompts by expression, intent or model, plus sensitive uploads and destructive tool calls.
In front of model APIs and MCP
Corporate sign-in, a decision on every model and tool call, and delegated tokens between agents and services.
Inside the model providers
Users, keys, usage and conversations. Revoke keys and suspend users from the console.
Every AI app, agent and MCP server, tied to a person.
/The AI people bring themselves
The browser extension sees sign-ins and sessions on any AI site, the OAuth consents people grant and the browser extensions they install, all attributed to the person signed in.
/The AI the company pays for
Users, keys, agents, usage and conversations from the model providers, Bedrock, Azure OpenAI, Entra Agent ID and Slack, joined to the same people.
/What agents actually call
The models, tools and MCP servers in use, seen as each prompt and tool call goes through a model hook or Gate.
/An owner for every agent
Each agent and key is tied to its owner or sponsor. Orphaned, dormant and never-expiring ones are flagged, including when the owner leaves. See what each one can reach on the graph, and find over-privileged agents before they're misused.
/Keys and roles resolve to people
Bedrock calls are followed through assumed roles to the SSO user, keys resolve to their owner, and human sessions are told apart from automation.
/Every prompt and decision, on record
Prompts, conversations, tool calls and policy decisions from every source, tied to a person and stored verbatim, redacted or as fingerprints. It all lands next to each person's groups, access and risk, so a policy or a detection can use it the moment it appears.
Block it before the model sees it.
Start in shadow mode and see what would be blocked, then block for the whole account, a group or one person.
Prompt or tool call
On its way to a model.
Hook asks SlashID
Before the model runs.
Policy and tags decide
On the prompt, the model, the file and the tool.
Allow, or block
The person sees the reason.
Expressions and models
Prompts that contain expressions you define, or that use models you haven't approved, for the account or for specific groups and people.
Sensitive uploads
Files tagged sensitive in the graph, matched by their content hash, stopped before the model sees them.
Writes and deletes
Tool calls by server and tool, or by what the tool does. SlashID infers whether a call reads, writes or deletes, so one rule stops every write.
Decide on what the prompt is for, and issue tokens to match.
Expressions catch the words. Intent catches the purpose, however the prompt is worded.
/Purpose, not wording
A prompt that asks to export customer data or delete a repository is blocked for what it means, not for the words it uses.
/Access cut to the task
The token issued for the task carries only the access its intent needs, so an agent asked to read cannot write.
/Policy on person and intent
The same intent can be fine for one team and off-limits for another. Policy decides on both the person and what they're trying to do.
/Kept with the decision
Each decision records the inferred intent next to the person and the policy, so a block can be explained and reviewed.
"prompt": "summarize churned customers" "intent": read · customer data ← inferred "person": "[email protected]" "policy": "Customer data: read for sales" "token": "crm.read" ← cut to task
Corporate sign-in and a decision on every tool call.
Run Gate as a gateway in front of third-party MCP servers, or as a sidecar beside your own servers and agents.
/Sign in once
A 401 challenge sends the MCP client to your organization's login. Gate accepts only tokens your organization issued to the clients you registered for the server.
/Decide every call
Each tool call is decided on the person's groups, tags and attributes, the tool, the arguments of a single call, and the time of day.
/A reason, not a dead end
A denial comes back as a tool result carrying the policy's reason, and tools a person would certainly be denied are hidden from the list.
/Each person, their own account
In front of vendor MCP servers like GitHub and HubSpot, Gate swaps the person's SlashID token for their vendor token, so the client never holds it. Not connected yet? The model shows a link to connect. Revoked? Access ends within five minutes.
/Hosted by SlashID, or run by you
Add a server in the console and Gate serves it in seconds. Or run it yourself, as a Docker image or a static binary.
/A sidecar with no way around it
No code change: Gate runs next to the MCP server or agent, on the same host or in the same pod. Bind the server to localhost and every call has to come through Gate. Already behind Envoy? Gate can run as its external authorization check instead.
Write a policy once, test it on real traffic.
/Rules or Rego
Build rules in the console, and drop to Rego when a rule needs more. Keep them in source control if you prefer.
/Monitor before you enforce
Run a policy in monitor mode and review what it would have blocked before it blocks anything.
/Dry-run on recorded traffic
Replay a draft MCP policy against the traffic Gate recorded, and see what it would allow and deny.
/Live in seconds
Gates pick up a saved policy within seconds, without a restart.
Every hop names the person, and narrows what it can do.
/No borrowed credentials
Every hop authenticates as itself, with a SPIFFE workload identity or an OAuth client. Standards-based token exchange (RFC 8693) keeps the person as the subject and records each agent as an actor.
/Privileges only shrink
Scopes stay a subset, lifetimes only shorten, audiences are allow-listed, and escalation fails closed. Each service's sidecar runs its own policy on what arrives.
/Ends at what you run
A service that trusts only your identity provider gets that provider's token for the same person. Nothing is impersonated, and the provider's conditional access is evaluated every time.
/One audit trail
Every exchange and decision is recorded with the full chain, and joins the identity provider's own sign-in log.
"sub": "[email protected]" "scope": "read" ← was read write "aud": "service-2" ← allow-listed "exp": ≤ subject's ← only shorter "act": { "sub": "service-1" "act": { "sub": "mcp-server" } }
Every block on record, with the person and the policy.
/Blocked requests, per policy
Each policy lists its latest blocks, linked to the person's activity.
/Detections when it looks wrong
Repeated blocks, sensitive files shared with AI, prompt injection and secrets in prompts.
/Every MCP decision
Gates you run report each decision with the person, the tool and, for a denial, the rule.
/Out to your tools
Detections and events stream to your SIEM, and webhooks start the response in SOAR and ticketing.
Inventory tools see it. Gateways block it. SlashID does both.
● full ◐ partial ○ none. Category comparison based on publicly documented capabilities; individual products vary.
Pairs well with.
Threat detection & posture
AI-evaluated detection and continuous posture management across humans, non-human identities and agents.
Explore use case →Identity Governance
Access reviews, workflows and just-in-time access for people, agents and non-human identities, on the access graph.
Explore use case →Stop impersonation attacks
Cryptographic mutual verification that replaces perception-based trust with mathematical proof.
Explore use case →
Scope an
AI / pilot.
Bring admin access to your AI providers, a pilot group and the AI clients they use, the files you treat as sensitive, and two or three MCP servers. You'll see an inventory of AI use tied to people, policies in monitor mode with a list of what they would have blocked, and your first MCP servers behind corporate sign-in.