How it works
Keep your agent.
Add the governance.
Your agents keep running where they run today. You declare them, route their model calls through IntSen, and the gateway applies your controls and records the evidence.
Your apps & agents
IntSen AI Gateway
POST /openai/v1/chat/completions
- waiting for a model call…
Approved model provider
OpenAI · gpt-5.4-mini
Select a control to see what it does · synthetic example
Four steps
Register. Connect. Govern. Understand.
Describe the use case and the agent in YAML
A Registration says which models the use case may use, how sensitive its data is and what it may spend. An Agent names its owners, its OAuth client and its per-turn limits. Apply both with intsenctl; a dry run shows the change first.
agent.yaml
apiVersion: governance.ai.intsen.com/v1kind: Agentmetadata: name: fleet-service-advisor namespace: field-servicespec: description: Diagnoses equipment issues for technicians. owners: [ { email: field-ai-owners@example.com } ] registration: field-service-assistant-prod clientIds: [ fleet-advisor-prod ] tasks: limits: { maxCostUsdPerTask: 0.50, maxDurationSeconds: 900 }Request lifecycle
What happens to every governed call
Access decisions fail closed: if the gateway cannot confirm who is calling, the call is refused. Guardrail checks fail open by default: a failed check is recorded and the call continues.
01 · Before the provider
Authenticate the client · resolve registration and agent · check provider, model and data class · validate the request · run input guardrails · check budgets and turn limits
02 · At the provider
Inject the provider key · remove IntSen headers · forward and stream the response
03 · On the way back
Run output guardrails (after completion or during streaming) · record tokens, cost, timings and verdicts
04 · After the turn
Close the turn after the grace window · total its cost · run task-level checks · score it with live evaluations · run compliance assessments if switched on
One turn, end to end
From a model call to an accountable agent turn.
Agent turn
Fleet Service Advisor · turn 2
- Duration
- 3.6s
- Calls
- 2
- Cost
- $0.0042
- Quality
- 92
Model asks for a tool
The model's response contains a tool call. IntSen reads it from the response body; the agent will run it.
- tool
- check_inventory
- call_id
- call_7f3a
- arguments
- { part: "PS-4410 pump seal", site: "Dallas" }
- finish_reason
- tool_calls
- output tokens
- 46
Illustrative product scenario — synthetic data
Use ↑ ↓ to move between steps
Visibility boundaries
What the gateway sees—and what it doesn't
IntSen is built on model traffic. That makes the integration light and the records hard to bypass or misreport, but it also sets clear limits.
Visible through the gateway
- Every model call routed through IntSen, with identity, use case, agent and turn
- Model, tokens, cost, latency, status and refusal codes
- Tool calls the model requested, and tool results the agent returned to the model
- Guardrail verdicts, evaluation scores and compliance findings
- Request and response content, when body capture is on
Not visible from model traffic alone
- Steps the model did not request, such as retrieval before the first call
- The execution of tools inside your agent
- Actions whose results are never returned to the model
- Retries and errors handled in your agent's code
- The exact answer shown to the user if your app changes it
- Calls that bypass the gateway with a direct provider key
Optional agent-side OpenTelemetry enrichment, to fill some of these gaps, is on the roadmap. It will add detail only; it will never be used for enforcement or billing.
Ready to make your enterprise AI accountable?
See how IntSen can help your teams govern access, safety, quality and spending across the AI applications and agents you already run.