What ships today.
Identity, a best-effort record of each call through the Gateway (tool calls too, on the routes that support them), spend, a kill switch, alerts and signed evidence. Of the 33 capabilities below, 30 are live and 3 are not available yet.
01Identity and access
5 live
05Alerts
5 live
07Continuous export
2 live
Stop one agent. Or all of them.
Hold the switch to suspend an example agent. The Gateway checks an agent's status on every call, after its key verifies, so the next call is refused with your reason. A call already in flight finishes.
Keyboard: hold Space or Enter.
The hold-to-suspend switch needs JavaScript. The panel shows what the agent’s next call gets back, active and suspended.
next call POST /v1/messages
- if active
- 200 forwarded to Anthropic
- if suspended
- 403 permission_error“Agent 'invoice-reconciler' is suspended: Spend spike overnight. Resume it from the Agents page in your FleetWarrant Dashboard; its Agent API key still works, so no client change is needed.”eventfleetwarrant.
call. denied · agent_suspendedalertcall.blocked
- Every agent
- The emergency stop suspends them all in one action, with one reason, and sends one alert for the lot rather than one per agent.
- Not touched
- Credentials the agent holds directly to other systems, such as Salesforce, NetSuite and Gmail. FleetWarrant doesn’t hold or revoke those.
- Revoke instead
- Revoking kills the Agent API key: the next call gets a 401 and writes no Event, and resuming never brings the key back. Rotate to issue a new one.
What each call asked for, and which tools it asked to run.
Sample traffic from eight agents on three providers, with one tool call no rule matches and one call the Gateway refused.
Sample audit log of agent LLM calls through the Gateway. The events are made up for this demonstration. Each row shows a timestamp, the agent, the Event's Action, the model and its token counts, and the call's total latency, provider time included. Where the model asked to run tools, a second line gives each tool call's Action, or unknown and the tool's name when no rule matches it. A call the Gateway refused is marked Blocked, with its reason. New sample events stream in continuously. Each row has a Pause here button that holds the stream still until it is pressed again, and the stream also holds while one of those buttons has keyboard focus. This description is not repeated for every event.
Sample audit log of agent LLM calls through the Gateway. The events are made up for this demonstration. Each row shows a timestamp, the agent, the Event's Action, the model and its token counts, and the call's total latency, provider time included. Where the model asked to run tools, a second line gives each tool call's Action, or unknown and the tool's name when no rule matches it. A call the Gateway refused is marked Blocked, with its reason. The log is shown still: no new events stream in. This description is not repeated for every event.
Sample events, generated in your browser. They are not live data. Hover an event to pause the stream, or tap it to hold it until you tap it again.
Sample events. They are not live data.
Latency is the whole call, provider time included. In our first measurements on production, in October 2026, the Gateway’s own share was about 130 ms per call.
Know the bill before the provider sends it.
The Spend page partway through a month, and the alert an agent's budget sends at 80%: to a Slack channel, and as a signed webhook your own tooling can act on.
Month to date
US$960.82
lower bound · 14 unpriced calls
Projected
US$1,742
at month end
By agent
- invoice-reconcilerUS$412.08
- support-triageUS$287.51
- release-botUS$164.90
- contract-reviewUS$96.33
Budget threshold reached
- Agent
- invoice-reconciler
- Threshold
- 80%
- Spent
- US$412.08 of US$500.00
- Projected
- US$748.20
X-FleetWarrant-Signature: t=1790000000,v1=5f2c…
X-FleetWarrant-Alert-Id: alt_01k5yq3z8v0c…
{ "type": "budget.threshold",
"data": { "level": "warning",
"threshold_percent": 80,
"spent_usd": "412.08",
"limit_usd": "500.00",
"projected_month_end_usd": "748.20" } }Figures above are illustrative. Agent costs are shown in US$ because that’s what the providers charge; FleetWarrant’s own prices are in A$.
Evidence your auditor can check without trusting us.
One signature covers the whole bundle: the manifest lists the SHA-256 of every file, and a FleetWarrant-owned KMS key signs the manifest. Each export covers up to 92 days; a longer period takes several.
- events.jsonlone Event per line
- summary.csvcounts per agent and model
- manifest.jsonSHA-256 of every file
- manifest.sigsigned with a FleetWarrant KMS key
- public_key.pemthe signing key's public half
- verify.pystandalone checker
- README.txthow to verify
Raw request and response bodies can be included too, if your Tenant has turned on raw capture. That option is admin-only.
$ pip install cryptography $ python verify.py evidence-export.zip --expect-fingerprint 9c1e… PASS: the manifest signature and every file hash verify. export: exp_01k6c2v8r4m9t3q7w1x5z0b2d8 (Tenant ten_01k2r7wq9d4hx8m3vznc6tp5ye) range: 2026-07-01 to 2026-10-01 (end exclusive) events: 48213 files: README.txt, events.jsonl, summary.csv, verify.py signing key: arn:aws:kms:ap-southeast-2:…:key/… fingerprint: 9c1e…
Change one byte and it prints FAIL with the reason. Get the signing key’s fingerprint from FleetWarrant over a channel other than the bundle, and pass it to --expect-fingerprint: an altered bundle could carry a key of its own. No Python? Three openssl and sha256sum commands do the same job.
A model allow-list today. Rules next.
FleetWarrant records and classifies each call made through the Gateway, and today it enforces exactly one rule: each agent may call only the models you allow it. Next is a policy engine: rules written the way you'd say them in a risk meeting, turned into allow, hold and deny decisions. It is in design, and not available yet.
Per-agent model allow-list
An admin sets which models each Connector may reach; each agent gets a primary model and any extras it needs, from that list. A request for any other model is refused at the Gateway, with a message naming the models the agent may use. On /v1/messages that’s a 404, the way Anthropic’s API reports a model you can’t use; on the OpenAI-format routes, a 403.
An illustration of the policy engine we’re designing. Nothing here is evaluated. A rule like this could only act on what the Gateway sees: the tool call a model asks for, never what NetSuite or Gmail then does.
The first of 3 sketched examples. Switching between them needs JavaScript.
Finance example shown.
Finance agents can create invoices under $5,000 but never approve them.