Your coding agent shouldn't be able to drop a table.
AMG sits between agents and MCP/REST tools, enforcing argument-level policy so agents act without ever holding real credentials.
One gateway. Every call adjudicated.
AMG stands between your agents and every upstream system — MCP servers and REST APIs. Agents authenticate to AMG, never to the tools themselves.
Process refund request flagged for manual review on order #48213.
Nothing happens off the record.
Every tool call AMG adjudicates is written to the audit table — identity, tool, reason, and decision.
| Agent | Tool call | Reason | Decision |
|---|---|---|---|
| claude-prod | notion.query_database | — | Allow ✓ |
| intern-bot | slack.delete_message | policy:read-only | Deny ✗ |
| claude-prod | github.create_issue | — | Allow ✓ |
| gpt-agent | stripe.refund_payment | no-billing-access | Deny ✗ |
| claude-prod | linear.create_issue | — | Allow ✓ |
| code-agent | postgres.execute_sql | arg:ddl-blocked | Deny ✗ |
| claude-prod | slack.post_message | — | Allow ✓ |
| external-agent | aws.ec2_terminate | unknown-identity | Deny ✗ |
| claude-prod | jira.create_ticket | — | Allow ✓ |
| intern-bot | github.delete_repo | tool-not-in-policy | Deny ✗ |
Connect your agents to see your own ledger here.
Deployment without governance is exposure.
If an agent can reach an MCP server, it can call every tool on it with any argument. That is the default state of agentic infrastructure today.
Unbounded tool access
Agents inherit the full surface of every connected server. A support bot can call stripe.refund_payment. A coding agent can call postgres.drop_table. Capability and authorization are conflated — nothing separates what an agent can do from what it should.
Models holding live credentials
To reach upstream tools, agents are handed real API keys — in system prompts, environment variables, and logs. Anything the model can read, the model can leak. A credential in the context window is a credential in the blast radius.
No forensic record
When an agent takes an action you didn't intend, there is no authoritative answer to which identity called which tool with which arguments — or which rule should have stopped it. You cannot govern what you cannot reconstruct.
The ledger, live in your terminal.
Every decision AMG makes is written to the ledger the moment it happens. amg audit tail streams it. Watch an agent request access, watch policy answer, and reconstruct exactly what your workforce did — down to the tool call.
$ amg audit tail --gateway prod
One binary. Works against self-hosted and cloud gateways.
amg agent create / amg key issue — provision agents and scoped keys from CI or your shell.amg policy / amg bind — author policies as code, bind them as roles.amg audit tree — the full delegation lineage: who created whom, and what each did.Your agents' agents.
The next operator of AMG isn't a person. It's an orchestrator.
Connect an orchestrator to AMG over MCP and it builds its own team. It creates agents, writes their policies, binds their roles, issues their keys — and revokes the whole tree when the work is done. You define the boundary once. The workforce assembles itself inside it.
This is safe for one reason: delegation only attenuates. An agent can grant a subset of what it holds. Never more. An orchestrator with read access mints readers. It cannot mint anything it isn't. Privilege flows downhill, and the ledger records every hop — who created whom, what each was allowed, what each attempted.
| AMG capability (over MCP) | What it does |
|---|---|
| create_agent | Mint a sub-agent identity, attenuated from the caller's own policy. |
| issue_key | Issue a scoped, TTL-bound credential for an agent. |
| bind_policy | Attach a policy to a role and bind that role to an agent. |
| revoke_agent | Retire an agent and every credential it issued, recursively. |
| audit_tail | Stream live decisions as AMG adjudicates them. |
| audit_tree | Reconstruct full delegation lineage — who created whom, what each was allowed. |
Exposed as MCP tools on AMG itself — any client holding a scoped key can call them, human or agent.
Autonomy without attenuation is escalation. Autonomy inside it is a workforce.
Delegation depth, child limits, and TTLs are enforced by the control plane. Every delegated key expires on its own.
Get access before general availability.
We're onboarding design partners directly. Tell us where to reach you and what you're securing.