FAQ

Yes. The Gap Register records missing procedures or ambiguous boundaries. Agents can draft proposed instructions; a responsible human reviews and approves them before they become operational policy.

A gap never widens an agent's authority. Until the proposal is approved by a person, no agent can cite it, and the work item that hit the gap waits for the owner named on the ledger.

No. Gateway Mode supports bringing your own agents. Route supported tool calls or MCP connections through GembaOS. We assess your tool interfaces and adapter requirements during the architecture consultation.

The agent keeps its own orchestration. What changes is that a sensitive tool call no longer reaches the business system directly; it reaches the capability gateway, which decides under policy and, where required, waits for a human signature.

Low-risk reads and operations within configured limits can pass automatically. Only actions that require approval under your policy go to a human, such as above-limit refunds or privileged production changes.

The route is decided by the policy, not by the agent. A refund within the delegated limit passes on the agent stamps; the same refund above the limit becomes an approval request for the finance owner. Both routes are recorded the same way.

Yes. GembaOS runs on-premises or in a private VPC with self-hosted models. Cloud models and external integrations create their own data paths; configure these deliberately, including gateway-level field scrubbing where appropriate.

Each tenant and each playbook can set a ceiling on which class of model provider may see which data, so a self-hosted model and a SaaS model can be mixed by data sensitivity rather than by role.

Our architects work alongside your team. Plan for an IT or DevOps liaison during setup and named business approvers during shadow mode. The exact effort depends on your integrations and is agreed when scoping the pilot.

No. GembaOS is a governance runtime, not an orchestration framework. It decides whether an action may happen and who must approve it, then executes it once under a clearance; the agent framework decides how the agent reasons and plans.

Agents built in LangGraph, Dify or a vendor CRM call GembaOS through the same gateway. GembaOS also ships its own agent loop for teams that do not have one, but nothing in the governance path depends on it.

The action is refused. GembaOS binds every clearance token to the hash of the approved arguments (argsHash). A call with different arguments does not match the clearance, is not executed, and the mismatch is recorded on the work item.

A clearance is also single-use and time-limited. Executing the approved action consumes it; a second attempt with the same clearance is refused in the same way.

External content is treated as data, never as authority. An instruction embedded in an email, a chat message, a log line or a picture cannot grant a capability, because the decision to allow an action is taken by the policy outside the model.

Content that looks like an injection attempt raises a typed concern on the work item. The host turns it into a risk flag, and a flagged action is routed to a person regardless of what the agent proposed. Images are re-encoded on ingest and only reach a model when the playbook and the model configuration both allow it.

Any model with a supported adapter, self-hosted or cloud. Policy checks, clearances and audit records sit outside the model, so a model can be replaced without changing the rules; shadow replay and golden tests show what a new model would have done before it goes live.

A single Linux binary with its own data directory, on a server you control. It serves its console over TLS or behind your reverse proxy, and connects to your systems through adapters (REST, file, SQL, a worker over mutual TLS). No external service is required to operate it.