The platform
Lineation is the LLM gateway and MCP gateway between your providers, tools, and internal systems—backed by zero-trust agent identity. Every agent gets a scoped non-human identity; every model call and tool call is policy-checked at the moment of action; every decision leaves an audit trail you can replay.
Three layers, adopt in order
Start by seeing what your agents do. Add controls. Then turn on active defense. Each layer stands alone and compounds with the next.
Real-time dashboards & decision logs
Policy-as-code, RBAC, identity & gateways
Runtime protection & containment
Identity and gateways
Zero-trust identity answers who is acting. The LLM gateway and MCP gateway answer what they may reach—and leave a record when they try.
Every agent receives a verifiable non-human identity tied to owner, scope, and authorized capabilities. Access is never assumed from a shared service account—it is continuously evaluated against policy. When a CISO asks who executed an action, the answer is a specific agent under a specific policy—not "the API key."
Sit between your agents and OpenAI, Claude, Gemini, Copilot, and the next provider you adopt. Requests are normalized into one schema, scored against runtime policy, then forwarded—or blocked—before a token reaches the model. Provider drift stays in the connector layer; your policies do not move.
MCP servers and tools inherit the same identity, policy, and audit path as model traffic. Tool calls are mediated like LLM calls: least privilege by default, allow/block/sanitize at decision time, and full lineage from prompt to tool to data to actor when something goes wrong.
Architecture principle
You define policy once, in a unified control plane, and enforce it everywhere—across every LLM provider and MCP server your agents use, at the endpoint where they execute, and in real time as actions are proposed.
Reference control flow
Every agent action follows the same path. Sub-second on the happy path; instant containment when a threshold is crossed.
Capabilities
Per-agent non-human identity with continuous authorization and least privilege—every action attributable to a scoped, owned agent.
Secure path between agents and every model provider: normalize, evaluate policy, then forward—or block—before tokens leave your boundary.
Mediate MCP tool and server traffic under the same identity, policy, and audit trail as LLM calls.
One language for what agents may do, where, and with whose data—normalized across OpenAI, Claude, Google Cloud, AWS, and Azure.
A local daemon enforces rules with a cached policy set, even under latency—where agents actually run.
Forensic-grade chains: prompt → tool → data → policy → output → actor. Query, export, replay.
Agent-behavior-aware scoring, calibrated to each agent's baseline—target false-positive rate under 15%.
Case management, containment options, and first-class SIEM/SOAR output. Extend the response stack you already run.
Customer- and auditor-shareable reports generated from the audit log in minutes—not a cross-functional scramble.
Architecture decisions
Easier governance and consistency across providers, at the cost of stricter high-availability requirements on the control plane. We mitigate with a local policy cache so enforcement survives a control-plane blip.
More upfront complexity in the connector layer, much lower long-term provider lock-in. When a provider changes its API, the adapter absorbs it—your policies don't move.
Stronger security posture with some initial user friction. High-risk operations require an explicit allow or an authorized override, which is itself logged.
Connectors for your active providers, daemon install, and policy bootstrap from templates. Your first defensible policy is live before your next security review.
