Brutor governs AI Systems: the agents, assistants, applications, workflows and services your teams run in production. Each one has an accountable owner, a stated purpose, and a contract of what it may use, spend and reach.
The control plane sits in the request path of routable traffic, where it enforces the policies and limits you set. Recording every call matters just as much: that record is how Brutor learns how each system normally behaves, and how it later proves whether it still does.
Three kinds of AI traffic reach the platform, and the platform is honest about the difference between them:
| Traffic | How it arrives | What Brutor can do with it |
|---|---|---|
| Routable AI Systems — agents, assistants, applications, workflows, services | Their base URL is the gateway | Governed — every call is enforced in the request path |
| Bought AI — Claude for Work, the OpenAI platform, Azure OpenAI, Microsoft 365 Copilot | Usage imported from vendor enterprise APIs | Observed — costed and attributed, never enforced |
| Shadow AI — agents, MCP servers and apps nobody registered | Collectors and scanner adapters send signed events | Discovered — inventoried, then converted into governed systems |
A control plane is a place decisions are made, and for routable traffic that place is the request path itself. An AI System points at one base URL, and from then on every call it makes takes one hop through the gateway, where the same checks run in the same order:
| Check | What it decides | Where it is configured |
|---|---|---|
| Identity | Who is calling: a person, an application, or an agent with its own name and owner | Users and API keys, agent identity |
| Access | Whether that caller may use this model, MCP server, skill or peer agent at all | Resource groups |
| Limits | Budgets, token and request quotas, throughput and concurrency caps, per-run ceilings | Limits, contracts |
| Policy | What the call would actually do, down to the arguments of a tool call, and what it means | Argument and semantic policies, approvals |
| Guardrails | The content itself: PII, secrets, prompt injection, jailbreak attempts, toxic content and your own banned words, on the way in and as the response streams back | Guardrails |
A call that fails any of them is refused before it leaves your boundary, so a runaway costs nothing. Model calls, MCP tool calls, A2A delegations and skill steps all take the same hop and the same checks: there is no second path where a different set of rules applies. The gate-by-gate walkthrough, with the status code each gate returns, is on the AI Gateway.
Because the decision happens here, the record is a by-product rather than a reporting exercise: who called, which model answered, what it cost, and which rule fired. That ledger is what assurance reads back, and what an audit is answered from.
Governing a request is the easy half. Proving that an AI System still behaves, months after it shipped, is the other one, and it rests on five things that only exist because every call was enforced in the same place:
unexplained, because a guessed cause is worse than none.
Liveness covers the failure drift cannot: the system that goes silent.Health is worst-of, never an average, and learning is never
rounded up to green. When a signal does fire, the response is graduated through the
system’s autonomy level rather than a single kill switch, and a
single misbehaving run can be stopped on its own.
Start with AI Systems if the term is new, then how assurance works.
A vendor app talks to the vendor’s own service, so nothing can stand in the path of those calls. What the platform does instead is count them, cost them, and give people a governed place to work:
You cannot govern an estate you have not finished counting, so Brutor counts first and asks you to decide second. Nothing in this plane intercepts a call or reads a payload:
The MCP Registry is your own subregistry on the official specification: it federates upstream registries, carries the servers your teams publish, and stamps every served record with its gateway-governance posture, so a developer browsing for a tool sees at a glance whether using it is sanctioned. The registry reports that status; the gateway is what grants it. Versions are immutable, and deprecating a server carries a status note back to every consumer.
No. It is a base URL and a key:
x-brutor-run-id and a
task’s calls group into a single run. Leave it out and every
call is still enforced, costed and logged.Developers
You build agents, chat clients and internal apps. You point your existing OpenAI or Anthropic SDK at the gateway, call MCP tools through one governed endpoint, or build a full custom portal on the Portal API. Guardrails, budgets and audit come for free — you never handle provider keys.
Platform & governance teams
You install and operate the gateway, decide which models and tools each team may use, set budgets and guardrails, and answer “what did we spend?”, “who did what?” — and “can we prove it?” — from Mission Control, the audit logs and the assurance reports.