Put every agent action through a governed gateway.

// Create the Application identity and its stable MCP gateway.
const agent = await axec.workspaceApi().createGatewayApplication({
  display_name: "Renewal assistant",
  idempotency_key: crypto.randomUUID(),
});

// Expose only the connectors this agent is allowed to use.
await axec.workspaceApi().replaceApplicationConnectors(
  agent.application_id,
  ["salesforce", "slack"],
);

# Pause matching writes for one scoped human decision.
policies:
  - key: renewal-actions
    effect: step_up
    approval_flow: revenue-review
    target:
      surface: proxy
      connector: salesforce
      method: POST

// Start secretless user authorization for this exact gateway.
import { AxecAuthClient } from "@axec/sdk/client";

const auth = new AxecAuthClient({
  baseUrl: AXEC_URL,
  clientId: PUBLIC_CLIENT_ID,
  redirectUri: CALLBACK_URL,
});

// Fresh state, verifier, and S256 challenge on every request.
auth.startAuthorization(GATEWAY_URL);

// Query role-aware runtime evidence for this workspace.
const { events } = await axec.workspaceApi().activity();

const decisions = events.filter(
  ({ event_type }) => event_type === "mcp.tool.decision",
);