Gateways and sync
The Gateway is where your policy is enforced. It holds a signed copy of your environment's configuration, checks every call against it, and keeps it current by contacting the Control Plane every 15 seconds.
Hosted or in your network
| Hosted by Gatelion | In your network | |
|---|---|---|
| Install | Nothing. Gatelion runs it. | You install it on a Windows or Linux machine with the registration code from the console. |
| Reaches | Systems on the internet only | Systems in your network, and on the internet |
| Secrets for your systems | Sealed in your browser for the hosted Gateway. The Control Plane never sees them in plain text. | Kept in the Gateway's own settings. The console only knows their names. |
| MCP address | Shown in the Gateways list | The machine's address, port 5200 by default |
| Your customers' agents | Possible | Not possible |
An organization usually has one hosted Gateway: the Usage page shows the limits that apply to yours. Choose In your network when your system isn't reachable from the internet. See Gateways and Install a Gateway.
A Gateway only ever connects out, to the Control Plane. You don't open any port toward it from the internet.
Snapshots
The Gateway never asks the Control Plane whether a call is allowed. It decides by itself, from a snapshot: your environment's agents, tokens, people, tools, connections and policy at one version.
- The Control Plane signs each snapshot. The Gateway refuses a snapshot whose signature doesn't check out, that's meant for another Gateway, or that's older than the one it has.
- Every change you save in the console raises the version. The Gateways list shows each Gateway's version, and whether an update is still pending.
- A snapshot expires after 7 days. A Gateway still holding one that old denies every call (
no_valid_snapshot).
Sync every 15 seconds
Every 15 seconds the Gateway contacts the Control Plane. It gets a signed heartbeat, and a new snapshot if something changed. The heartbeat is what keeps the Gateway's configuration fresh. The Last sync column shows when it last happened.
The Gateway also checks for approval decisions every 5 seconds, and reports what happened to calls every few seconds.
When a Gateway loses contact
A Gateway that can't reach the Control Plane keeps working on its last snapshot for a limited time, then stops by itself:
| Kind of call | Keeps working without contact for |
|---|---|
| Reads | 1 hour by default |
| Writes that need no approval | 15 minutes by default |
| Calls that need approval | Not at all: they wait, and run only after the Control Plane has re-checked them |
After that window, the Gateway denies those calls with stale_snapshot. When reads are too stale, an agent's tool list shows only get_execution_status. Once contact is back, everything works again at the next heartbeat.
These windows are set per environment. An admin changes them on Settings, under If a Gateway loses contact with Gatelion:
- Reads stop after: 5 minutes, 15 minutes, 1 hour, 4 hours or 24 hours.
- Changes stop after: 1 minute, 5 minutes, 15 minutes or 1 hour. It must be no longer than the time for reads.
Gateways apply new times at their next sync. The same times are also the longest a stopped agent, a revoked token or a policy change can take to reach a Gateway that can't sync: shorter is safer, longer rides out outages. The If it loses contact column of the Gateways list shows the values for each Gateway. After a restart, the Gateway counts as stale until its first successful sync.
Kill switches
You can stop things in the console at any time:
| To stop | Where | What callers get |
|---|---|---|
| A whole Gateway | Gateways, the Running switch | Every call is denied with gateway_disabled. Agents see only get_execution_status. |
| An agent | Tools & agents → Agents, the switch on the agent | HTTP 401 for every request |
| One token | Tools & agents → Agents, Revoke next to the token | HTTP 401 for requests with that token |
| A tool | Tools & agents → Tools, the Available switch | unknown_tool |
| A Gateway, for good | Gateways, Retire under a stopped Gateway's switch | Its next sync is refused, and it can never serve agents again. |
A Gateway must be stopped before it can be retired. Retiring is final: besides refusing the Gateway's syncs, it cancels the requests that came through it and are still waiting, stops it counting toward your limits, and for a hosted Gateway switches off the tools of its connections. Its history stays. See Retire a Gateway.
How fast they work
A connected Gateway applies a switch at its next sync, so within about 15 seconds. It isn't instant: calls already running finish, and a call can still start in the seconds before the sync.
Calls that need approval are stopped at once. Switching off an agent or a tool, or retiring a Gateway, cancels its requests that are waiting for approval or approved but not yet running. And before any approved call runs, the Control Plane checks the current state, so a switched-off Gateway, agent or tool can't get permission to run. Stopping a Gateway with its Running switch doesn't cancel its requests, but none of them can run while it's stopped. See Approvals.
A Gateway that has lost contact never hears about the switch. It stops through the windows above instead: by default, writes after 15 minutes and reads after 1 hour. That's the worst case, and the Gateways list shows it for each Gateway.
Related: How a call is governed, Settings, and Limits and defaults.
Still stuck? Contact support from the console.