Tenant-aware access
Callers authenticate into a workspace; roles constrain who can register endpoints, change policies, and set spend ceilings.
Product tour
One transaction, end to end.
In under two minutes, this walkthrough shows how a platform team configures a route, applies policy and budget, and inspects the resulting transaction and receipt.
Sample transaction
Configure one governed transaction.
Choose a caller, destination, policy, and spend limit. The control plane compiles the request into a signed transaction, evaluates the route, and returns a complete gateway trace for review.
Interactive
Connection request
Gateway trace
Processing steps
01
Authenticate callerResolve identity, principal, and tenant workspace
Ready02
Compile the signed requestBind principal, authority, spend limit, and task into one signed record
Ready03
Evaluate policy and budgetCheck allowed route, spend ceiling, timeout, and evidence level
Ready04
Select authorized destinationConfirm the registered downstream endpoint
Ready05
Return result and receiptShow route, timing, evidence pointers, and the receipt reference
ReadyWhat you learn in the tour
The same path operators use in the control plane.
Each step mirrors a real workspace action, from resolving identity and compiling the transaction record to evaluating policy and budget, selecting the route, and capturing the receipt.
Bounded transactions
Allowed destinations, spend limits, timeouts, and evidence levels are configured before traffic flows, and every transaction carries them.
A receipt every time
Every evaluation produces a transaction ID, route decision, timing, status, and a receipt reference operators can export.
Next step
Follow the request into the Azure architecture.
See where identity, routing, queues, data, secrets, and observability live in the private-beta system.
Open the architecture