Do I have to rewrite my agent?

No. Hexgate ships adapters that wrap an existing OpenAI Agents, LangChain / LangGraph, Google ADK, or Pydantic AI agent without touching its logic. Swap your runner for HexgateRunner (or call wrap_langchain_agent / wrap_pydantic_agent) once. Your original agent object is left intact; the wrapper holds the policy and gates every tool the agent can invoke.

How is Hexgate different from guardrails, firewalls or an MCP gateway?

Those sit around the agent. Firewalls and proxies see network traffic, guardrails filter prompts and outputs, and MCP gateways see which tools get called. None of them know who the end user is, what the agent is meant to do, or its state in the current turn. Hexgate runs inside the agent and decides each tool call against the caller's role, the actual arguments and the turn's context, before it runs. It complements those layers rather than replacing them.

Does gating every call add latency or a network round-trip?

No per-decision round-trip. Policy is evaluated in-process, either by the default pydantic engine or in production by a compiled WASM bundle run via wasmtime. The bundle is fetched once and refreshed only at turn boundaries with an ETag / 304 check, so individual decide() calls never leave the process.

What happens when a call is denied?

A denial isn't a crash. The tool returns a [policy_denied] (or [approval_required]) marker that the model sees as the tool result, so the agent can recover or try a fallback instead of aborting the run. On Pydantic AI it surfaces as a ModelRetry; on LangChain as a structured {ok: false} result.

How do approval-required tools work?

Mark a tool approval_required in policy, then pass an approval_handler when you wrap: True (auto-approve), False (auto-deny), or a sync/async (action, context) -> bool callback that inspects the specific call. hexgate chat prompts the terminal, hexgate serve auto-approves, and native code does whatever you wire.

How does per-user scope work if one agent serves everyone?

Identity and rules are decoupled. A per-request User context manager carries who is calling (user_id, role, session_id, optional ttl) as a signed biscuit token; role policy files decide what that role can do. Role is resolved at call time from a contextvar, so a single wrapped agent serves many users concurrently without seeing each other's policies. Unlike governance toolkits that key policy on agent_id alone, Hexgate threads the end-user identity through every decision. The same agent code runs with different effective permissions depending on which user invoked it.

What does a policy actually look like?

A policy.yaml is deny-by-default with a tools map; each tool gets a mode (allow / deny / approval_required) and optional constraints like args.amount , >=, in, not in, all ANDed. The same constraint strings compile to OPA Rego for the WASM engine and run in-process for pydantic. A parity test suite proves both produce identical decisions.

What makes a production bundle trustworthy?

Bundles are signed. The manifest carries a SHA-256 of every artifact (including the wasm_hash) plus a detached Ed25519 signature over that manifest. The hashes authenticate the files; the signature authenticates the manifest. Set HEXGATE_BUNDLE_REQUIRE_SIGNATURE=true to refuse anything unsigned or unverifiable. The signing key is the same root that signs your biscuit tokens.

Do I need the platform, or can I run the SDK alone?

The SDK runs standalone: YAML on disk, in-process enforcement, no Docker or browser. The optional platform (a FastAPI control plane + React dashboard) adds browser policy editing, mintable tokens, a live Playground decision stream, and an append-only audit log in ClickHouse. Edit policy in the UI and the next turn picks it up.

Hexgate Blog: AI Agent Security, OWASP & Authorization

Latest

Secure your AI agent in 5 minutes with identity-aware authorization

Your AI agent doesn't know who is asking. Add identity-aware, per-user authorization to an OpenAI Agents SDK agent with Hexgate in two lines, and let security own the policy.

Guillaume PotelSeptember 18, 20266 min read

Read the article

All articles

HexgateSecurityTutorial
Secure your AI agent in 5 minutes with identity-aware authorization
Your AI agent doesn't know who is asking. Add identity-aware, per-user authorization to an OpenAI Agents SDK agent with Hexgate in two lines, and let security own the policy.
Guillaume PotelSeptember 18, 20266 min read
AI AgentSecurityOWASP
2026 will be the year of security for AI agents
Agents now log in, hold tokens and call tools at machine speed. From deleted production databases to poisoned emails, here is why 2026 is the year agent security becomes the main event.
Quang LeJuly 24, 202617 min read
OWASPSecurity
The Ten Ways an AI Agent Gets You Owned
A plain-English tour of the OWASP Top 10 for Agentic Applications 2026: what each risk, ASI01 to ASI10, looks like when it actually goes wrong, and what to fix first.
Quang LeJuly 24, 202612 min read

Field notes
from the gate.

Secure your AI agent in 5 minutes with identity-aware authorization

All articles

Secure your AI agent in 5 minutes with identity-aware authorization

2026 will be the year of security for AI agents

The Ten Ways an AI Agent Gets You Owned

Hexgate is an open-source project created by Hexamind.