Developer documentation

Ponte sits at the policy enforcement point (PEP) between agents and tools. Every call is evaluated by the policy decision point (PDP) before it runs. This page is a starting point for architects and platform engineers.

Architecture

Deploy Ponte inside your VPC or private cloud. Agents connect through your AI gateway, MCP server, or SDK. The PEP forwards context to the PDP, which evaluates policy and returns allow, deny, or escalate-to-human.

Ponte PEP, PDP, policy store, and audit receipts in your VPC

Standards & policy language

OAuth 2.0 / OIDC — user and service identity for delegation
Token exchange — narrow scopes from person to agent to action
SPIFFE / SPIRE — workload identity for agent runtime
AuthZEN — authorization API patterns for policy evaluation
MCP — tool calls governed at the gateway
Policy-as-code — versioned rules tested before production

Example authorization receipt

Every allow or deny produces a tamper-evident receipt for audit and compliance.

{
  "receipt_id": "rcpt_8f2a91c4",
  "timestamp": "2026-10-19T04:12:08Z",
  "decision": "allow",
  "subject": {
    "type": "agent",
    "id": "agent://support-bot/prod",
    "on_behalf_of": "user:alex@example.com"
  },
  "action": {
    "tool": "mcp://servicenow/update_ticket",
    "operation": "write",
    "resource": "INC-4421"
  },
  "policy": {
    "id": "delegation-refund-cap-v3",
    "effect": "allow",
    "obligations": ["log_delegation_lineage"]
  },
  "context": {
    "ticket_status": "approved",
    "amount_usd": 45
  },
  "signature": "ed25519:…"
}

Quickstart & integration paths

AI / LLM gateway — inline PEP (Envoy ext_authz-compatible patterns)
MCP — govern tool invocation before downstream systems
SDK — embed checks in custom agent runtimes

API reference

Policy evaluation, receipt export, and PEP configuration APIs are documented for design partners. Request a demo for access.