What a gate actually is

Most agent products now have an approval button. Clicking yes before a model calls a tool is not the same as a model that cannot call it. Here is the difference, in the terms your security review will use.

Approval on a tool vs a structural gate

Approval in front of a toolA gate on agentOS
Who holds the credentialThe agent process. The approval screen sits in front of a tool the model can already call.The runtime. The model never receives a write-capable tool or a secret; secrets resolve from SSM at commit time.
What is approvedA tool call the model composed.A payload against a capability you declared on the pipeline. If you did not declare the write, the call does not exist — not a rule the model follows, a door that is not there.
Who can approveOften the model itself ("confirm: yes").A person, or a keyword filter. An LLM yes or no is not a gate.
What a retry doesPosts again.Hits the same idempotency key. The receiver dedupes; the ledger shows one commit.
What the record saysA log line.Trace id from the conversation to the block, the policy version in force, the reviewer, the runtime identity, the capability.
Several agents on one jobEach one with its own tools.A coordinator block runs the roles; none of them can commit. Only the pipeline’s gated side effect does.

The shape of it: the model proposes a payload. The pipeline names the capability it is for. A review step — a person, or a keyword filter — decides. The runtime commits with its own credentials and writes the receipt. Design the pipeline in nQube; the runtime is agentOS.

How a step picks its model

Reliability lives in the runtime, so the model does not have to be the biggest one available. Each call starts on the lowest tier its route allows and moves up only on a failure the runtime can verify.

  • localAn open-weight model on your own node or the appliance. Classification, extraction, drafts that stay inside.
  • bulkA low-cost hosted model. The default for most steps.
  • strongA capable hosted model. Required when a call carries tools or a long context.
  • frontierThe largest models. Reached by escalation or an explicit pin, under a share cap.

Rules

A call that carries tools, or more than 60k prompt tokens, starts at strong. Routes can set a starting tier per stage — triage on bulk, the planner on strong.

Escalation

Bad JSON, a tool-parse error, an empty answer, or a faithfulness score under threshold moves the call up one tier and retries — at most twice. A vague answer does not count.

Caps

A ceiling on the hourly share of tokens that reach frontier; past it, policy-resolved calls use strong. A monthly spend cap per organization that stops with a 402.

Your endpoint

Point a tier at an https endpoint you control, with your key. A model you trained is a name you serve there. A box with no inbound door is not reached by a tunnel — that is not built. It needs an https front door, or it runs on the App Kit network below.

On the instance

The App Kit self-host stamp runs vLLM or Ollama on the instance network. Nothing is published. The local tier is that model.

Dev Console gateway

Dev tools, hosted instances and the Dev Console call one OpenAI-compatible endpoint and name a virtual model — nventr/auto, strong, bulk, local, nventr/embed, nventr/image, nventr/video — and the policy above decides. Or name any model in the catalog directly: chat, embeddings, image and video generation across OpenAI, Anthropic, xAI, Google, OpenRouter and fal.ai. Each plan includes a monthly hosted-model allowance; past it, calls draw a prepaid balance you top up, and keys you bring are never metered. We do not train the model.

All of it is live configuration on your organization: tiers, starting routes, escalation triggers, caps. Change a number, not a deploy.

Run this on your documentsPricing