Adding control should feel like adding observability

Agents can request a policy decision, resume an approved action, verify a decision receipt and inspect their own identity.

Evidence: Tenant-scoped endpoints under /api/gateway, authenticated by an agent credential.

Gateway failures return an HTTP status and a stable reason code; rate limits also return Retry-After.

Evidence: Gateway responses cover missing, invalid, expired, revoked, quarantined and rate-limited credentials.

A versioned public reference, runnable examples and an OpenAPI document are planned.

Evidence: No public OpenAPI document is shipped today.

A no-card sandbox with a first-call path under ten minutes is planned.

Evidence: No self-serve sandbox credential is shipped today.

A supported Python client is planned.

Evidence: No Agent Trust Cloud Python package is shipped today.

A supported TypeScript client is planned.

Evidence: No Agent Trust Cloud TypeScript package is shipped today.

A downloadable, dependency-free CLI runs pre-deployment agent safety tests and can fail a CI job on critical findings or regressions.

Evidence: The built file dist/cli/atc-agent-safety.mjs is downloadable from /platform/agent-safety-testing and covered by CLI execution tests.

A broader CLI for agent registration, policy testing, gateway setup and diagnostics is planned.

Evidence: The safety-testing CLI is live; registration, policy-test and gateway-setup commands are not shipped today.

A generic proxy that applies gateway controls to tools without a bespoke connector is planned.

Evidence: No generic HTTP or OpenAPI proxy is shipped in the server today.

Signed outbound security-event webhooks are planned.

Evidence: No customer security-event webhook surface is shipped today.