Advanced security

Trusted Gateway: keep credentials away from the agent.

Local permissions decide whether a tool may run. Trusted Gateway goes further: Quasentra stores the business credential and performs a narrowly configured operation on the server.

WITHOUT GATEWAYAgent process holds the credential

A compromised process may attempt to use the API, database or mailbox directly.

WITH GATEWAYAgent requests one named operation

Quasentra checks policy, injects the encrypted secret and enforces connector restrictions.

When do you need it?

Use the basic SDK wrapper first. Add Gateway when a tool reaches production data, external communication, money or a credential that should never enter the agent process.

1. Create a connector in the dashboard

  1. Run the secured application once so the agent and action appear.
  2. Open Dashboard → Trusted Gateway → Create connector.
  3. Select the exact agent and tool action.
  4. Choose HTTPS API, PostgreSQL read-only or SMTP email.
  5. Add the allowed route/query/domain and the credential.
  6. Save and validate the connector.
No administrator ticket is needed. Each workspace configures its own connectors. Saved secret values are encrypted and are not displayed again.

What Validate checks

The Validate button checks the saved fields, connector restrictions and whether encrypted credentials exist. It does not contact the remote API, database or mail server. Always complete one controlled staging execution before production.

2. Request execution from your tool

result = security.execute(
    agent_id="support-agent",
    session_id="ticket-100",
    action="customer.read",
    arguments={"route": "customer", "path_params": {"customer_id": "CUST-100"}},
    idempotency_key="ticket-100-customer-read",
)

if not result["executed"]:
    # DENY or REQUIRE_APPROVAL: do not treat this as a tool result
    handle_security_decision(result["decision"])
else:
    customer = result["output"]

Values you must customize

ValueMeaning
agent_idThe agent selected on the connector.
session_idYour conversation, job or workflow ID.
actionThe exact registered action connected in the dashboard.
argumentsOnly the data accepted by that connector type.
idempotency_keyA stable unique ID for this business operation. Reuse it only for the same retry; never generate a new one after an uncertain side effect.

Choose a connector

HTTPS API →PostgreSQL read-only →SMTP email →