AgentGate stops any LangChain, CrewAI, OpenAI Agents SDK, or hand-built agent at the exact moment it's about to send, delete, deploy, or pay — and hands that one decision to a human in Slack or Teams, before it happens instead of after.
The problem
Agents are getting capable enough to actually do things — not draft an email, send it; not suggest a deploy, ship it. That's the whole point of building them. But "autonomous" and "unsupervised" aren't the same thing, and right now most teams don't have a real answer for the gap between them — just a hope that nothing expensive goes wrong.
AgentGate isn't a safety net for every action an agent takes. It's a checkpoint for the small number that are irreversible if it gets it wrong.
How it works
One method call in your agent's code. Everything after that is AgentGate's job, not yours.
The agent calls gate.request_approval() with the action, risk tier, and context — then blocks, waiting.
A card posts to Slack or Microsoft Teams — whichever channels the org has connected — with the full context attached.
IN REVIEWA human clicks Approve or Reject. Rejections require a reason. Nothing else in the system can skip this step.
DECIDEDThe waiting call returns. The agent proceeds, stops, or — if nobody answered in time — treats silence as no.
CLEARED / HELDThe manifest
Not a wrapper around a single Slack message. A full approval system: the SDK your agent calls, the channels humans respond in, and the record of what happened.
| № | Item | What it does — and why it matters |
|---|---|---|
| 01 | Python SDK | One call — request_approval() — async or sync, with typed results and typed exceptions.Why: you write four lines, not a queueing system. |
| 02 | Slack integration | A real bot: interactive Approve/Reject buttons, a reason modal on reject, HTTP callbacks with signature verification.Why: your team already lives in Slack — the decision happens where they already are. |
| 03 | Microsoft Teams integration | Incoming Webhook + Adaptive Card, resolved through signed, single-use links — no Azure app registration required.Why: Teams shops don't get left out because Slack was easier to build first. |
| 04 | Risk tiers | Low / medium / high / critical — set explicitly, or auto-classified from the action name and context, configurable per org.Why: a typo in a Slack message and a $50k wire transfer shouldn't wait the same 30 minutes. |
| 05 | Timeouts & auto-expiry | Every request has a deadline. A background worker marks it timed-out the moment nobody answers in time.Why: fails safe — silence blocks the action, it never defaults to yes. |
| 06 | Live dashboard | Pending count, approvals over time, risk distribution, and a filterable table you can approve or reject directly from.Why: you shouldn't need to read Slack scrollback to know what's outstanding. |
| 07 | Full audit log | Every request, every decision, who made it and why, exportable to CSV.Why: "an agent did something bad" becomes a five-minute lookup, not an investigation. |
| 08 | Multi-tenant by default | Each org signs up, gets its own API key and its own isolated data — nothing shared, nothing crossed.Why: you're not the only team using your own AgentGate instance. |
| 09 | Hardened by default | API keys hashed at rest, integration tokens encrypted, rate limits on by default.Why: this is the thing standing between an agent and real actions — it doesn't get to be the weak link. |
| 10 | Self-hostable | SQLite for local dev, Postgres for real traffic, Docker Compose or your own infrastructure — no vendor lock.Why: the audit trail of your agents' decisions is not something you should have to trust to someone else's database. |
Who's stopping at the gate
Under the hood
FastAPI, Postgres, a Next.js dashboard. Read the code, self-host it, or run it next to your own infrastructure.
No response before the deadline is treated as a rejection, never an approval. Silence never means yes.
The audit log lives in your database. Export it, query it, keep it as long as compliance requires.