Straight answers, before the demo.

Barely, if your agent lets you set its model base URL and API key. Point it at the FleetWarrant Gateway with its own Agent API key instead of calling your LLM provider directly. For an OpenAI-compatible or Anthropic client, that’s a base-URL and key swap, not a new SDK to install or a sidecar to run. Streaming and tool calls work on every Connector, and the docs list which routes each provider supports. The systems your agent’s tool calls reach on the other side need no changes at all.

You point your agents at the Gateway and it records every call they make through it, classified and written to your audit trail. You can suspend any Agent or revoke its key, stop them all at once, limit which models each may call, and get alerts on budgets and unusual spikes. What it doesn’t do yet is judge individual calls against rules. That’s scoped to the agents you’ve registered: FleetWarrant doesn’t discover agents running elsewhere in your business that never call the Gateway, and it has no visibility into what a downstream system would let an agent do if it tried. A policy engine that can hold or block a call based on rules you write is not available yet.

Only where you can set the agent’s model base URL and API key. An agent built on an OpenAI-compatible or Anthropic SDK, or entirely in-house, that lets you change both authenticates through the same Gateway and lands in the same audit trail, whoever built it. A tool that only offers a sign-in to its vendor’s account, with no base URL or API key setting, can’t be routed through FleetWarrant. Nor can an agent that never calls the Gateway, which FleetWarrant won’t discover.

Their calls through FleetWarrant fail. The Gateway sits in the request path, so while it is down an agent pointed at it can’t reach its LLM provider, and there is no automatic bypass. It keeps failing until the Gateway is back or you point the agent back at your provider yourself. The Gateway runs in one region, Sydney, with no failover. If only the audit write fails, the call still goes through, with no Event, and an alarm fires. There is no SLA and no availability commitment yet.

In our first measurements on production, in October 2026, the Gateway’s own processing took about 130 ms per call: checking the Agent API key and the model allow-list, forwarding the call and recording the Event. Network time comes on top. The Gateway runs only in Sydney, so an agent and a provider that are both far from Australia add two long-haul trips to every call. Time a few calls from where your agents run before you rely on a figure.

There are two levers. Suspend an Agent and the Gateway refuses its calls, with the reason you gave; its key stays valid, so resuming needs no change on the client. Revoke its Agent API key when the credential itself is compromised, and the Gateway rejects it in its own auth check, not on a delay. Neither reaches back to stop a call already in flight, and neither touches the separate credentials an agent may hold to downstream systems, such as Salesforce, NetSuite or Stripe. Those keep working until you rotate them. This stops the agent talking to its LLM provider through FleetWarrant; it isn’t a system-by-system shutoff.

An admin uses the emergency stop. It suspends every Agent in your Tenant, and the Gateway refuses their calls. Agent API keys stay valid, so “resume all” needs no client change, and it resumes only the Agents the stop suspended: one you’d suspended by hand, or that a circuit breaker suspended, stays suspended. Both the stop and the resume are recorded as Events, with who did it.

No. Budgets are alert-only. Set a monthly budget per Agent or for the whole Tenant and FleetWarrant alerts your Slack channel or webhook as spend crosses each threshold, with a daily reminder while you’re over. It never stops or slows a call because of a budget or a usage threshold. A person decides what to do, and the alert links to the Agent, where it can be suspended.

Agent-call costs are in US dollars, because that’s what the providers charge: each call is priced at its provider’s US$ price, with no currency conversion. A call we can’t price shows as unpriced, never as $0, so any total that includes one is marked as a lower bound. FleetWarrant’s own plan prices are in Australian dollars.

Yes. An evidence export’s manifest lists the SHA-256 of every file in the bundle and is signed with a FleetWarrant-owned KMS key. The bundle carries the public key and a standalone verify.py that needs only Python and the cryptography package, or you can check it with openssl. Compare the key’s fingerprint with the one FleetWarrant gives you over a separate channel, not with the bundle’s own copy, so a bundle someone re-signed fails.

Yes. An admin can set up continuous export to Splunk HEC, Datadog Logs or a signed HTTPS webhook. Delivery to your own S3 bucket, which FleetWarrant writes to through a role in your account with an external ID, works too. Every destination gets the same versioned JSON record as an evidence bundle. Delivery is at least once, so use event_id to de-duplicate.

FleetWarrant’s production environment runs in AWS Sydney (ap-southeast-2) only, and the Gateway processes your requests there. Your LLM provider processes the prompt wherever it runs, which may not be Sydney. Sydney is where production runs today. It isn’t yet a contractual data-residency commitment. Each Tenant’s records are encrypted under a KMS key of its own; that’s logical isolation on shared infrastructure, not a dedicated environment per customer. EU regions, on-prem deployment and hardware attestation, which we plan for the enterprise tier, are not available yet.

By default, no. The Gateway sees each request and response in the clear while it forwards the call, because it has to. What FleetWarrant keeps is a redacted preview of each call, encrypted under your Tenant’s own KMS key, plus the call’s metadata. A fixed ruleset removes secrets, US Social Security numbers, email addresses and card numbers from the preview. It isn’t general PII redaction, so a name or an address can still appear in it. A Tenant admin can turn on raw capture. While it’s on, the full request and response are archived as well, sealed under a per-Event key, and anything the preview removed is still in that raw copy. Each raw body can be shredded on request or by your raw-body retention, and a legal hold pauses shredding. The archive is Object-Locked in GOVERNANCE mode for 1 year by default, and FleetWarrant’s application never deletes an archive object.

If you have one agent in production with real credentials, it isn’t. Design partners get direct access to the team, and a say in the policy packs we build first.