Drop a gateway in front. Traffic runs through policy.
You should not have to rewrite your application to govern it. A Swiftward gateway sits in front of what you want to control, and every request passes through your policy on the way.
Where it sits, and why your agent never notices
You already have an agent that calls an LLM, an MCP server, or the network. Change one thing — the base URL it points at, or a line in how it is deployed — and every call runs through your policy. The agent's code does not change. The alternative is your application calling our API on every decision: more flexible, but you have to write the integration.
The gateways
An OpenAI- and Anthropic-compatible proxy. Point your SDK at a new base URL and every prompt and response runs through policy.
Proxies MCP tool calls: allow or deny each tool, add parameters the caller never sees, and hold two identities — who is calling, and which credential goes to the provider.
Sits in front of an agent's outbound calls and decides which destinations it may reach, using the rules you write.
Every order on the FIX protocol passes through policy before it reaches the venue: position and notional limits, price collars, restricted instruments, per-desk controls.
Takes GitHub and GitLab webhooks, runs the change through policy, and writes back a check or status.
A JSON-RPC proxy in front of your node. Reads pass through; a submission is decoded out of the signed bytes — the asset, the recipient, the amount — and decided before it reaches the network.
What an agent can reach
Put the LLM, MCP, and network gateways in front of the same agent and one set of rules decides what it can reach: which models it may call, which tools it may invoke, and which destinations it may open a connection to. For an autonomous coding agent, that is the difference between hoping it behaves and setting a limit on what it can do.
Identity and keys, handled
The gateway owns authentication, so your agents never hold credentials they should not.
Bring your own provider key and the gateway forwards it. Or let it hold a pool and choose per request: a rule states how sensitive the content is, and the agent states the minimum it needs. Only a provider trusted with at least that much can serve the call, and the caller never sees which key answered.
Sensitive data is detected and redacted before the prompt leaves, and the record shows what was redacted and what was not, per decision. Why we state it that way and not as a guarantee.
One engine behind all of them
A gateway is an entry point. Behind every one is the same engine, the same versioned policy, the same audit trail. Govern your LLM calls, your agents' tool use, your order flow and your code changes with one set of rules, instead of a separate tool for each.
What happens when Swiftward is unreachable
You declare it per endpoint. A call that moves money or takes an action is normally set to fail closed, and a model call is normally set to let traffic through, because the answer depends on what the call does and that is your judgment rather than ours.
One thing is not configurable: a rule that errors while it is being evaluated fails closed. An unevaluated safety rule is unknown risk, so the call is refused.