Behavior can change without a traditional redeploy.
Prompts, configuration, or runtime instructions can change access strategies without the slow release cycle that many control programs assume.
Why It Exists
Why OpenScope
Use OpenScope when the agent should not have the dangerous path at all.
Gateways solve a real problem
AI gateways are valuable for routing, policy, visibility, and review. But they mainly govern traffic paths. They do not remove the dangerous primitive from the agent runtime.
- Centralized control across many agents and tools
- Model and provider routing
- Org-wide policy and visibility
- Session logging and review
- Fast additive rollout
Filtering a raw path is not the same as removing it
A gateway assumes the agent may reach a raw privileged tool and tries to inspect that path. OpenScope removes that tool from the agent path and exposes a smaller approved capability instead.
The key management difference
Some teams need stronger assurance than tool filtering alone. They need proof that the agent never held the key, token, or broad permission. In OpenScope, the key stays inside the broker.
Why agentic workflows change the security equation
Traditional enterprise tools change through release and deployment. Agentic systems also change through prompts, tool config, runtime instructions, and skill updates. Their effective access pattern can shift much faster.
Agents search for alternate paths.
A gateway often protects a path. A capable agent searches for any path that completes the task. Removing the raw primitive becomes more attractive than trying to perfectly inspect every route.
Ask a better question
Ask whether the product leaves the raw privileged primitive exposed to the agent. That is the clearest dividing line between traffic governance and execution containment.
vs the agent's own auto mode
OpenScope makes auto mode safe to leave on
Every coding agent ships an autonomy dial, Claude Code's accept-edits and bypass modes, Cursor's auto-run, Codex's full-auto. That dial answers one question: should the agent pause to ask a human? OpenScope answers a different one: what is the agent allowed to do, enforced where the agent cannot override it. They are different layers, and together they let you turn autonomy up without removing the guardrail.
Ask every time
Approve each sudo, ssh, and package install by hand. Safe, but every action interrupts you, the friction that makes teams reach for auto mode in the first place.
Bypass / YOLO
Approve nothing. The agent's allow-list is in-process and editable by the agent itself, so a prompt injection sits one step from your production keys. Fast, with no backstop.
Brokered with OpenScope
The agent acts on its own, but every privileged op runs as a scoped action against a root-owned policy it cannot rewrite. No human tap, still bounded.
What moves off your plate
- Install a signed package, team-ID and path-prefix gated.
- Restart a service on the test box, that target and service only.
- Tail logs or read metrics on an early-production host.
Each used to stop and ask. Now it runs inside scope, scoped, audited, no tap.
The metric that matters
Track the share of agent actions that still need a human. Auto mode alone forces a trade between that number and your blast radius. OpenScope drives it down without going unbounded, the actions that still ask you are the ones that should.
Comparison and fit
OpenScope addresses a narrower problem than generic AI governance or secret management tools. The comparison is clearer when each category is mapped to the trust boundary it controls.
AI gateways
Best for routing, visibility, centralized policy, and traffic governance across many agents and tools.
Secret vaults
Best for keeping credentials away from agents and users, but not for defining a full scoped action surface.
MCP gateways
Best for managing tool exposure, but still often closer to gateway infrastructure than a strict brokered-capability model.
OpenScope
Best when the system owner wants the agent to use approved capabilities without ever possessing the raw path underneath.
Comparison table
OpenScope is not trying to replace every governance or secret-management layer. It is for the narrower case where raw privileged access should disappear from the agent path.
When to use what
Different layers solve different trust problems.
Use a gateway when
- You need broad traffic-plane governance.
- You need centralized model or tool routing.
- You need visibility and review across many AI paths.
Use OpenScope when
- You need execution-plane containment.
- You do not want the agent to ever hold the raw primitive.
- You need action-level and parameter-level policy.
- You need tighter bypass resistance.
Use both when
- You need broad governance and strong containment.
- You want centralized traffic policy plus brokered privileged actions.
- Different layers solve different trust problems.