What a gate actually is

Most agent products now have an approval button. Clicking yes before a model calls a tool is not the same as a model that cannot call it. Here is the difference, in the terms your security review will use.

Approval on a tool vs a structural gate

Approval in front of a toolA gate on agentOS
Who holds the credentialThe agent process. The approval screen sits in front of a tool the model can already call.The runtime. The model never receives a write-capable tool or a secret; secrets resolve from SSM at commit time.
What is approvedA tool call the model composed.A payload against a capability you declared on the pipeline. Undeclared means the call never happens.
Who can approveOften the model itself ("confirm: yes").A person, or a keyword filter. An LLM yes or no is not a gate.
What a retry doesPosts again.Hits the same idempotency key. The receiver dedupes; the ledger shows one commit.
What the record saysA log line.Trace id from the conversation to the block, the policy version in force, the reviewer, the runtime identity, the capability.
Several agents on one jobEach one with its own tools.A coordinator block runs the roles; none of them can commit. Only the pipeline’s gated side effect does.

The shape of it: the model proposes a payload. The pipeline names the capability it is for. A review step — a person, or a keyword filter — decides. The runtime commits with its own credentials and writes the receipt. Design the pipeline in nQube; the runtime is agentOS.

How a step picks its model

Reliability lives in the runtime, so the model does not have to be the biggest one available. Each call starts on the lowest tier its route allows and moves up only on a failure the runtime can verify.

  • localAn open-weight model on your own node or the appliance. Classification, extraction, drafts that stay inside.
  • bulkA low-cost hosted model. The default for most steps.
  • strongA capable hosted model. Required when a call carries tools or a long context.
  • frontierThe largest models. Reached by escalation or an explicit pin, under a share cap.

Rules

A call that carries tools, or more than 60k prompt tokens, starts at strong. Routes can set a starting tier per stage — triage on bulk, the planner on strong.

Escalation

Bad JSON, a tool-parse error, an empty answer, or a faithfulness score under threshold moves the call up one tier and retries — at most twice. A vague answer does not count.

Caps

A ceiling on the hourly share of tokens that reach frontier; past it, policy-resolved calls use strong. A monthly spend cap per organization that stops with a 402.

Your keys, your gateway

Bring your own provider keys; they stay in the runtime. Dev tools and App Kit instances call one OpenAI-compatible endpoint and name a virtual model — nventr/auto, strong, bulk, local — and the policy above decides.

All of it is live configuration on your organization: tiers, starting routes, escalation triggers, caps. Change a number, not a deploy.

Run this on your documentsPricing