Skip to main content

Deployment

Manage gateways

Gateways in the Console lists each gateway registered to your organization, when it last connected, and the agent that it serves. A gateway is the verdictan process that applies your rules and calls the model provider.

The Console record and the running process are separate. Creating a record does not start a gateway, and deleting a record does not stop an installed service.

For your first gateway, use the quickstart. Use this page to add more gateways and to look after the ones you have.

Register a gateway​

You need an agent with a configuration. The gateway host must have the provider credentials that the configuration uses.

  1. Open Gateways and select Register gateway.
  2. Enter a Gateway ID, such as support-test-1.
  3. Select the agent for this gateway.
  4. Select Create registration.
  5. Copy the Runtime registration command.
  6. Set the provider environment variables on the gateway host.
  7. Run the command on that host.
  8. Return to Gateways and wait for the first report from the gateway.

The command contains the API address, the runtime registration ID, and a machine token. The Console shows the machine token one time only. Keep it out of screenshots, tickets, and shared shell history.

To run the gateway in a container, put the same values in the Compose file from the quickstart in Docker.

The gateway opens an outbound connection to Verdictan, and the agent address forwards requests through that connection. You do not have to open an inbound port on your router.

Verify a gateway​

  1. Open the gateway and select the Overview tab.
  2. Examine the last connection time, the agent, and the configuration version.
  3. Send one model request through the agent address with your application token.
  4. Examine the response and its recorded decision.

You can also read the delivered request events with your signed-in CLI profile:

verdictan events tail --since 10m --json

On a host that runs a local configuration file, check how the gateway loads the file and resolves its credentials:

verdictan gateway check --config policy-config.yaml

gateway check does not send a model request.

Read the fleet status​

The list tells you these things about each gateway:

SignalMeaning
RegisteredVerdictan has a record for the gateway.
Recently seenThe gateway sent a recent report.
HealthyThe last health check that the gateway reported passed.
AgentThe gateway serves that agent.
ConfigurationA configuration is assigned or reported. Compare its version and sync state.

A recent report or a 200 from /healthz shows that the process runs. It does not prove provider access. Send a request to test that.

A missing metric does not mean zero. The gateway may have had no traffic, reported late, disconnected, or your account may not have access to the metric.

Detail tabs​

TabWhat it shows
OverviewEndpoint, agent, configuration, health, and a Context Fabric summary
RuntimeRuntime and provider measurements for a period
TagsLabels for grouping and classification
AuditChanges recorded for the gateway

On the host of an installed service, verdictan gateway status reports the local process state. See verdictan gateway for the service commands.

Replace a machine token​

Replace the machine token if a person who must not have it can see it. The gateway page has no rotation control. Use the API operation POST /v1/gateways/{id}/machine-token with an administrator API token and the API address of your region.

Rotation revokes the active runtime tokens of the gateway, so plan a short maintenance period.

  1. Call the rotation operation for the gateway.
  2. Save the new token in protected storage. The API returns it one time only.
  3. Put the new token in the secret source of the gateway.
  4. Stop the gateway and start it again with the new token.
  5. Make sure that the gateway reports again.
  6. Send a test request.
  7. Find the rotation record in the Audit tab.

Give each gateway record its own machine token.

Remove a gateway​

  1. Stop the application traffic that uses the gateway.
  2. Remove its agent link.
  3. Make sure that no control manifest declares the gateway.
  4. Keep the audit evidence that you need.
  5. Delete the record from Gateways.

If the gateway runs as a service, also stop or remove the service on its host.

Next steps​