Run agents on enterprise data, safely.
One control plane between every agent in your estate and the systems it touches, so identity, policy, cost and audit are properties of each request instead of promises in a document.
Cloud, VPC, or airgapped · SOC 2 · ISO 42001 · EU AI Act ready
Most agents never get past the pilot. They hit the same three walls.
Production means read-write access to real systems. An agent should earn that the way your workforce does: with an identity, the right level of permission, and a full record of everything it does.
The agent holds someone's keys.
It inherited a person's OAuth grant, so it can do anything they can. There is no sub-identity to scope, nothing to revoke, and no way to answer which agent did what on whose behalf.
Nobody knows what it can reach.
Each team wired its own connection to production. API keys live in DMs, allowlists have no owner, and the inventory of what AI can touch exists only in people's heads.
The bill arrives after the fact.
Spend shows up as one line per provider with no way to attribute it, and a runaway prompt loop is something you discover on the invoice rather than stopping at the cap.
All three are one problem: nothing sits between the agent and what it touches. Put a data plane there and they stop being policy questions.
In the path, not beside it.
Every agent, one you built here, one your engineers wrote, or a coding tool on someone's laptop, reaches your systems and your models through the same four stages.
Identity
Every request carries a short-lived, scoped identity for the agent and the person it acts for. Secrets stay in the vault; the gateway attaches the real credential at call time.
- BYO-IDP over OIDC, so agents sign in the way your people do
- On-behalf-of tokens: a Slack mention acts as whoever sent it
- Permission scoping per agent, revocable in one place
- A leaked agent config leaks nothing: the credential was never in it
Guardrails
Policy runs here, before anything leaves. Fields get masked or dropped, risky calls get refused.
- Mask, hide or drop fields a tool returns, per tool, per agent
- Row filters, so whole records never reach the model
- Tool-level deny; destructive operations gated
- Token ceilings and spend caps that reject rather than report
MCP Gateway
Every tool call is brokered through one place: hosted connectors with auth handled, per-agent tool scoping, and field-level policy on the reply.
- 21 hosted MCP servers, 300+ sources through Redpanda Connect
- An agent only sees the tools it needs
- Code Mode lets an agent compose calls in a sandbox, same policy applies
- Immutable audit log of every call, streamed to your SIEM
AI Gateway
Your keys and your models behind one OpenAI-compatible endpoint, with routing, failover, per-agent cost attribution and budgets that refuse at the cap.
- 56 models across 6 providers, or your own self-hosted models
- Failover to the same model on another provider, no code change
- Spend attributed to the agent, team and model that caused it
- No token fees. You are billed at your own negotiated rates
Adopt one. The others are already behind the same endpoint.
They are separate products with separate value, which is why you can start with whichever hurts most. What they share is the request path, and that is why governance is identical wherever the agent came from.
Assemble a declarative agent from a model, ready-made tools and a prompt, or register the agent you already wrote and have it inherit the same governance.
How it works →MCP GatewayEvery tool call brokered through one place: hosted connectors with auth handled, per-agent tool scoping, and field-level policy on the way back.
How it works →AI GatewayYour keys and your models behind one OpenAI-compatible endpoint, with routing, failover, per-agent cost attribution and budgets that refuse at the cap.
How it works →The four questions this has to survive.
Consolidate without betting the estate.
- One control plane instead of a tool per team
- No forced data-platform decision. Works alongside Foundry, a lakehouse, Azure or M365
- Legible TCO you can defend when the CFO asks
- EU AI Act posture you can show a board
Make AI spend attributable and cappable.
- One consolidated line instead of a dozen overlapping tools
- Cost per team and per agent, forecastable
- Ceilings that refuse requests at the cap, not report the overrun
- No token resale. You keep your own negotiated provider rates
Replace shadow AI with a sanctioned path.
- Runs in your cloud, your VPC, or airgapped, with hard egress boundaries
- BYO-IDP over OIDC, on-behalf-of tokens, permission scoping per agent
- Audit-ready trail of every action, streamed to your SIEM
- Governs agents across the estate, not only ours
Give engineers a credible build path.
- BYOA registry: LangChain, CrewAI, ADK, Mastra, Vercel AI SDK
- Open protocols end to end: MCP, A2A, OTel, on native Kubernetes with CI/CD
- One gateway with BYOM and multi-model choice
- Open enough to sit beside what you already run
"The hardest part of AI isn't building applications, it's trusting them with sensitive data. Redpanda gives enterprises the guardrails and speed we need to actually put agents into production."
Kannan Dorairaj · Chief Architect, LiveRamp
Built for the future. Available today.
Four surfaces carry production traffic now. One is in preview and one is not built, and we would rather you learn that here than in month two.
Bring an agent you are about to deploy.
In thirty minutes we will show you what it can reach today, and what it can reach once the plane is in front of it.
Cloud, VPC, or airgapped · SOC 2 · ISO 42001 · EU AI Act ready