Gate form factor
Reverse proxy
BetaTerminate proof in front of an existing service. The Gate runs the eight-stage check order and forwards only what survives it (no application change required).
How it sits
In reverse-proxy form, Gate terminates proof in front of an existing service without requiring application changes.Shippinggateway-service on port 8095 with /gate/challenge and /gate/invoke.
- gateway-service exposes /gate/challenge and /gate/invoke (port 8095).
- Route config binds endpoint_id, policy_hash, methods, TTL, and freshness.
- Upstream receives only requests that cleared the check order.
- Burn events and access logs flow back to Control visibility.
Configuration surface
Per-endpoint policy
endpoint_id, policy_hash, method allow-list, TTL, and use count (scoped to the route being protected).
Freshness window
Tune how long an envelope remains valid for each route. Captured envelopes die when the window closes.
Fail-open vs fail-closed
Choose reject-when-Control-is-unreachable, or an explicit break-glass path for emergency access.
Audit mode
hash_only for compact evidence, or full capture when you need the complete request transcript.
When to choose proxy
- You need to protect a service you do not want to recompile.
- Edge or DMZ termination is the natural enforcement point.
- Multiple backends share one Gate instance and per-route policy.