Rust Performance
L2 + L3 built with axum + tokio. 599 req/s on cache-hit path. 18ms P50. Zero-copy SSE streaming. No Python wrappers in the hot path.
On-Prem · Sovereign · Commercial
Govern AI before it governs your budget.
The self-hosted gateway that unifies API traffic, LLM calls, and autonomous agents in one control plane.
Three layers. Per-hop agent identity. Zero data leaving your network.
terminal
$ docker compose up -d
[+] Running 8/8
$ curl localhost:9080/healthcheck
✓ API Gateway ready 50k TPS · P99 < 50ms
✓ AI Gateway ready 599 req/s cache-hit · Rust
✓ Agent Gateway ready MCP + A2A · Rust
_
Built on Apache APISIX
|
L2 + L3 built in Rust
|
13 LLM Providers
|
Commercial support
Your AI stack is three tools duct-taped together.
Platform engineers managing AI workloads are running separate tools for the edge, the LLM layer, and agents. Three auth systems. Three dashboards. Three 2am incidents.
Shadow AI burning budgets
Teams calling LLM APIs with no governance. A runaway prompt loop burns $50K over a weekend. Finance cannot forecast AI spend.
Three systems, zero unification
Kong for the edge. LiteLLM in the middle. A separate agent runtime. Three repos, three auth configs, three observability stacks.
Agents with zero governance
Autonomous agents calling tools with no allowlists, no session budgets, no human approval for high-risk operations. MCP + A2A are here, but who governs them?
There's a better way.
One gateway. Three layers. Shared everything.
Click a layer to explore. All three share tenant_id, Redis, ClickHouse, and OTel traces.
API Gateway — Apache APISIX
Battle-tested L7 proxy handling all inbound traffic. 50k TPS at P99 < 50ms on production hardware. Per-tenant rate limiting, JWT auth, and every request logged to ClickHouse.
- ●Per-tenant rate limiting — Redis-backed sliding window, bucket key:
rl:{tenant_id}:{route}:{window} - ●JWT auth + Keycloak — tenant_id extracted from JWT claims, validated before routing
- ●ClickHouse request logging — async via http-logger, Buffer engine for high-write throughput
- ●Key auth — service-to-service API key validation with tenant scoping
- ●Grafana dashboard — request rate, error rate, P99 latency per tenant
L1 performance (local Docker)
Throughput50k TPS
P99 Latency< 50ms
Plugin overhead< 1ms
Stack
APISIX
Lua
etcd
Redis
Keycloak
Shared across all layers
tenant_id
Propagated end-to-end from JWT to ClickHouse
Redis
Rate limits, caches, sessions, budgets
ClickHouse
Request logs, AI usage, agent audit trail
OTel + Jaeger
Cross-layer distributed traces
Why developers choose gatez
Not marketing claims. Measured results from real deployments.
Multi-Tenant by Default
tenant_id in every API call, every log entry, every cache key. Rate limit buckets, token budgets, tool allowlists — all tenant-isolated from day one. Not bolted on.
Cross-Layer Traces
One span tree from APISIX → AI Gateway → agent tool call. See an HTTP request become an LLM call become a tool invocation. OTel + Jaeger. No competitor has this.
Agent Governance
MCP + A2A protocol support. HITL gates for high-risk tool calls. Tool allowlists (deny-by-default). Session budgets. Tool poisoning detection. A2A loop detection.
Self-Hosted
Docker Compose to start. Kubernetes for production. Air-gap capable. Your data never leaves your infrastructure. HIPAA, GDPR, ISO 42001 ready.
Commercially Supported
Professional deployment, integration help, and dedicated support. Compliance packs for FHIR, PSD2, FedRAMP. Multi-year SLAs for production workloads.
Per-hop agent identity
Know exactly who authorized what, at every hop in the delegation chain. Not just which agent called which tool — which human started it, which agents delegated it, and how the authorization flowed.
Without per-hop identity
Agent A delegates to Agent B. Agent B delegates to Agent C. Agent C calls a tool.
Your logs show: agent_id=C, tool=delete_customer
Question: Which human authorized this deletion?
Question: Did Agent B have authority to delegate this to Agent C?
Question: What permissions were carried through the chain?
Compliance asks, "Who authorized this?" You have no answer.
With per-hop identity (gatez)
Same scenario. But every delegation hop creates a new token via RFC 8693 token exchange.
// Audit log entry
tool_call: "delete_customer"
agent_id: "C"
delegation_chain: [
{ actor: "user:alice@acme.com", scope: ["agent:*"] },
{ actor: "agent:A", scope: ["delegate:B"] },
{ actor: "agent:B", scope: ["delegate:C"] },
{ actor: "agent:C", scope: ["tool:delete_customer"] }
]
Answer: Alice authorized it.
Answer: Yes, Agent B's token contained delegate:C scope.
Answer: Every hop narrowed permissions (principle of least privilege).
Full chain logged. Auditable. Traceable. On-prem.
How per-hop identity works
1
Initial authorization
Human user authenticates via Keycloak, receives JWT with sub=user:alice@acme.com. Creates agent session.
2
Delegation hop
Agent A delegates to Agent B. L3 performs RFC 8693 token exchange: issues new token with sub=agent:B, act={sub: "agent:A", iss: "alice@acme.com"}.
3
Audit + enforcement
Every tool call logs the full chain. Gateway enforces: Agent B can only delegate if policy allows. Scopes narrow at each hop (never expand). ClickHouse stores chain for compliance export.
No competitor offers this. Kong has no agent gateway. agentgateway.dev has no per-hop identity architecture. AWS AgentCore is cloud-only. Gatez ships this on-prem, today.
How gatez compares
Not every tool does every job. Here is what each platform actually ships.
| Feature | gatez | Kong | Portkey | agentgateway |
|---|---|---|---|---|
| API Gateway (L1) | ✓ | ✓ | ✕ | ✕ |
| AI Gateway (L2) | ✓ | Partial | ✓ | ✕ |
| Agent Gateway (L3) | ✓ | ✕ | ✕ | ✓ |
| All 3 layers unified | ✓ | ✕ | ✕ | ✕ |
| Cross-layer traces | ✓ | ✕ | ✕ | ✕ |
| Multi-tenant native | ✓ | Partial | ✕ | Partial |
| Self-hosted / air-gap | ✓ | ✓ | ✕ | ✓ |
| MCP + A2A protocols | ✓ | ✕ | ✕ | ✓ |
| HITL gates | ✓ | ✕ | ✕ | ✕ |
| Per-hop agent identity | ✓ | ✕ | ✕ | ✕ |
| Per-tenant token budgets | ✓ | Enterprise | ✕ | ✕ |
| Two-portal control plane | ✓ | Partial | ✕ | ✕ |
| API lifecycle governance | ✓ | Partial | ✕ | ✕ |
| Source-available | ✓ | Partial | ✕ | ✕ |
See full comparisons:
Running in 60 seconds
Clone, start, call. That request goes through rate limiting (L1), PII redaction (L2), and token budget enforcement (L2). All logged. All traced.
quick-start
# Start the full stack
$ docker compose up -d
# Your first API call through all 3 layers
$ curl -H "Authorization: Bearer $TOKEN" \
-H "x-tenant-id: acme" \
http://localhost:9080/v1/chat/completions \
-d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}'
L1 rate-limited, JWT-validated, logged to ClickHouse
L2 PII-redacted, cache-checked, budget-enforced
L3 session-tracked, tool-allowlisted, audit-trailed
Solutions
AI Cost Control
Stop shadow AI from burning your budget. Token budgets, semantic caching, per-tenant cost analytics.
Learn moreAgent Governance
Give agents tools. Keep humans in control. HITL gates, tool allowlists, session budgets, A2A policies.
Learn moreRegulated AI
AI governance that satisfies your auditor. Full air-gap, PII redaction, complete audit trail, no data leaves your network.
Learn moreAPI Monetization
Meter, limit, and bill every API call per tenant. Self-service developer portal, API key workflows, usage export for billing.
Learn moreBuilt for production. Supported for compliance.
Commercial platform with professional support, compliance packs, and production SLAs. Your infrastructure, your control, our expertise.
On-Prem
Air-gap capable
3 Layers
Unified platform
Rust + Lua
Performance-first
Commercial
Production support
Need production support?
On-prem deployment assistance. Custom Keycloak/SSO integration. SLA guarantees. Architecture review. Dedicated support channel.