4.1 Permissions
Permissions is every agent on this machine down one side, and what the one you picked may do beside it. The same card is on the agent's own page.
An agent can be given less than it came with, without editing its own configuration.
Tools
Around forty switches, in six groups:
| Group | Covers |
|---|---|
| The terminal | Running a command, reading a running command's output, stopping one — three separate switches |
| Reading the project | File reads, listings, search |
| Changing the project | Writes, edits, deletions |
| The internet | Fetching pages, web search |
| Planning and delegation | Task planning, sub-agents |
| MCP | One switch per MCP server that agent has installed |
- The switch on a group's header sets the whole group at once; open the group and the answer gets as fine as you like.
- A tool whose switch is off is taken out of the request before it leaves this machine, so the model is never offered it and the agent never gets to call it.
- Every agent names its tools differently.
Bash,shellandrun_shell_commandare all the same switch. - Each group ends in a catch-all for tools Gateway has never seen, which is what closes a group for good rather than only for the tools that happened to be listed the day it was set.
Models
Any model, only the ones you pick, or all but them. A name may end in *, so claude-opus-* covers a whole family.
Providers
Which of the providers this agent's requests may be sent to.
What a refusal looks like
A request that asks for something switched off comes back as a permission_error in the API the agent speaks, so it reads as a refusal rather than as a broken gateway.
Where the rules are enforced
Two enforcement points, and the page says which one an agent is in:
| Agent | Tools | Models and providers |
|---|---|---|
| Routed through Gateway (3.2) | Taken out of the relayed request | Enforced on every request |
| Not routed, but monitored (2.3) | Refused by the hook Gateway installed, before the tool runs | Not enforced — nothing passes through Gateway to hold |
| Neither | — | — |
Underneath: Casbin
The switches compile to a Casbin policy, and every relayed request is decided by an enforcer rather than by a hand-written check.
Advanced shows the model.conf and policy.csv they compile to, and takes extra policy lines of your own:
p, claude-code, model:claude-opus-*, use, deny
p, claude-code, model:*, use, allow
p, claude-code, tool:shell/run, use, deny
p, claude-code, tool:mcp/github, use, allow
p, claude-code, tool:mcp/*, use, deny
p, claude-code, tool:*, use, allowThe first rule that matches decides, which is what lets one exception stand in front of the rule behind it: every MCP server taken away except the one that stays.
The lines you write yourself are checked before the ones the switches wrote.
Next: 4.2 LLM Records.
3.6 Model routing and automatic fallback
The reason it exists: an agent picks its own model names. Claude Code asks for claude-sonnet-4-5 for your turn and claude-haiku-4-5 for its background summaries, whatever it is configured with; Codex Desktop remembers the model chosen in its own state and ignores the config file. Point either at a provider that never heard of those names and the model in the request is not a name that provider serves.
4.2 LLM Records
Every request an agent relayed through Gateway: the full system prompt, every message and tool call, the schema of every tool the model was offered, plus tokens and cost.