Cytra Gateway how Cytra delivers compliance
The governed gateway between your AI agents and everything they touch.
Cytra Gateway is the mechanism behind Cytra's compliance: a managed MCP gateway and agent control plane. Every tool call runs through per-tenant policy, credential brokering, and a deny-by-default execution gate — and every call becomes tamper-evident audit evidence. Every gateway audit event maps to SOC 2 and the WCB catalog. Policy, tool-lifecycle, anomaly, encryption, and tenant-isolation events also map through the published crosswalk to NIST AI RMF, ISO/IEC 42001, and EU AI Act Art. 9, 10, 13, 14, 15, and 72. The Art. 12 record-keeping anchor for a plain tool call is not in that crosswalk yet. Alignment, not certification.
Cytra Gateway is in private beta and is not yet generally available. Self-host deployments and dashboard-configured BYOK are operator-provisioned for early-access tenants.
The problem
Agents are getting hands. Someone has to govern what they reach.
The moment an AI agent can call a tool, it can touch a database, a clinical API, or a production system — usually holding a long-lived credential and leaving no durable record. Cytra Gateway sits in the middle of that connection and makes every call governed by default: policy first, scoped credentials second, a deny-by-default execution gate third, and a verifiable record last.
How a call flows
Five deterministic steps. Every one of them audits.
The same governed path runs on every invocation.
- 01
Tenant + tool resolution
The tenant comes from the verified token, not the Host header, and the tool is matched to that tenant. A cross-tenant tool is denied — and audited.
- 02
Policy evaluation
A deterministic, per-tenant policy engine runs in document order with zero external calls: prod-write blocks, IP allowlists, PII redaction. Budget ceilings and approval gates are supported rule kinds not yet enforced on the served path. An operator kill-switch can deny everything instantly.
- 03
Credential brokering
The per-tenant vault decrypts a downstream credential ephemerally and returns a short-lived, tool-scoped token. The raw key is never returned to the agent.
- 04
Sandboxed execution
Tools are designed to run inside a deny-by-default sandbox with a hard timeout and no implicit network egress, with capabilities granted per tool, not assumed. Isolated execution nodes are not yet provisioned; until they are, the served gateway denies execution rather than running untrusted code.
- 05
Tamper-evident audit
The call — success or denial — is appended to a per-tenant SHA-256 hash-chain. Reorder, delete, or mutate one record and the chain fails verification.
One platform
A gateway, the governance around it, and the record it leaves.
Cytra Gateway is the flagship of a broader AI-governance platform. Capabilities tagged Private beta ship to early-access tenants. The compliance-attested MCP tool marketplace is tagged Planned and is not available yet. Bias and fairness monitoring is part of the same private beta.
- Private beta
Managed MCP gateway (bring your own client)
A hosted Model Context Protocol surface your existing MCP-compatible agents connect to. You point your client at the gateway; the governance happens in between.
- Private beta
Deterministic policy + kill-switch
Per-tenant rules evaluated identically every time, with no external calls in the decision path. A single operator kill-switch denies every invocation on that control plane instantly.
- Private beta
Credential brokering / per-tenant vault
Downstream credentials stay envelope-encrypted per tenant. The gateway issues short-lived, scoped tokens per call so raw keys never reach the agent.
- Private beta
Sandboxed tool execution
Tools are designed to execute inside an isolated, deny-by-default runtime with a hard timeout, with network and filesystem access granted per tool, never assumed. Isolated execution nodes are not yet provisioned; the served gateway denies execution until they are.
- Private beta
Runtime DLP + prompt-injection defense
Inline guardrails redact PII and screen for prompt-injection on the request and response path, so sensitive data and hostile instructions are caught as the call runs.
- Private beta
NHI / agent-identity governance
Treat agents and non-human identities as first-class principals: each has a scoped identity, its own policy lane, and its own audit trail. Access cannot be back-filled.
- Private beta
Compliance-as-record
Every gateway audit event maps to SOC 2 and the WCB catalog. Policy, tool-lifecycle, anomaly, encryption, and tenant-isolation events also map through the published crosswalk to NIST AI RMF, ISO/IEC 42001, and EU AI Act Art. 9, 10, 13, 14, 15, and 72. The Art. 12 record-keeping anchor for a plain tool call is not in that crosswalk yet. An auditor portal and attestation API are on the roadmap. Alignment, not certification.
- Private beta
Independently-verifiable WORM audit
Every event lands in a per-tenant, append-only hash-chain designed for an external party to verify. Denials are recorded, not silently dropped.
- Planned
Compliance-attested MCP tool marketplace
A shared catalog other tenants can discover and install is planned, not available. Tools for one tenant still pass the gateway's ingest, schema-pinning, and signing pipeline before they can be published to that tenant, and untrusted bytes never become a live tool unattested.
- Private beta
Bias & fairness monitoring
AIF360-aligned fairness metrics and drift detection run on a schedule against configured eval datasets; threshold breaches raise audit-trail entries, not just dashboard pings.
Compliance-as-record
The audit pack is a by-product of operating.
Because every governed call is already a structured, signed record, the gateway turns runtime telemetry into continuous evidence. Every gateway audit event maps to SOC 2 and the WCB catalog. Policy, tool-lifecycle, anomaly, encryption, and tenant-isolation events also map through the published crosswalk to NIST AI RMF, ISO/IEC 42001, and EU AI Act Art. 9, 10, 13, 14, 15, and 72. The Art. 12 record-keeping anchor for a plain tool call is not in that crosswalk yet. Instead of reconstructing what happened the week before an audit, you read the chain.
We describe Cytra's posture as aligned, not certified. The platform maps evidence to these frameworks; it does not assert that any certification has been granted. An auditor portal and attestation API are on the early-access roadmap.
SOC 2 TSC and WCB-CC — every gateway audit event, including a plain tool call.
NIST AI RMF, ISO/IEC 42001, and EU AI Act Art. 9, 10, 13, 14, 15, and 72 — policy, tool-lifecycle, anomaly, encryption, and tenant-isolation events, through the published crosswalk.
The Art. 12 record-keeping anchor for a plain tool call is not in that crosswalk yet.
Per-tenant WORM hash-chain designed for independent verification of the evidence itself.
Built to be inspected
- Topology
- Cloudflare + AWS + Kong
- SOC 2
- Aligned (self-assessment)
- Deployment
- Self-host path; dashboard BYOK
- Your data
- Never trained on
- Availability
- Private beta
SOC 2: Aligned (self-assessment); auditor engagement pending; no report issued. Production infrastructure (isolated execution nodes, WORM object storage, the Konnect data plane) is provisioned as early-access tenants onboard. BYOK currently means gateway-side provider keys configured through the Cloudflare dashboard/provider-key model, not customer-managed runtime keys in Cytra. Read the reference architecture.
Next step put a control plane in front of your agents
Govern every agent action, and keep the record.
Tell us about your agents and the systems they reach, and we'll scope private-beta access for your team.