Why I built OLO ToolGate: authorization at the AI tool boundary

Description and use

ToolGate provides fine‑grained control over AI tool usage by separating routing from authorization and recording all decisions for audit.

Problem

AI agents can act on behalf of users, raising the need to control which tool calls they can make at runtime.

Outcome

ToolGate provides a policy‑driven, auditable execution flow that separates routing from authorization, enabling fine‑grained control over AI tool usage.

Workflow

• Register an MCP server in ToolGate
• Scan the server’s tools and approve which to expose
• Enroll a device and obtain a permit
• When an agent requests a tool call, ToolGate evaluates policy
• If ASK, pause the call and wait for human approval
• If ALLOW, redeem the permit and execute the call
• Record request, approval, and outcome in the audit log

Evidence

ToolGate is an open-source, self-hosted security gateway for AI agents, MCP servers, and tool execution.

Source

For each governed invocation, it evaluates one of three decisions: ALLOW, ASK, BLOCK.

Source

The Gateway dispatches the call. The control plane evaluates authorization and issues a single-use permit. The executor must redeem that permit with the control plane before running the call.

Source

The quickstart creates separate administrator and reviewer accounts.

Source