zeqtrio.
Platform

The control plane for agent-to-everything access.

A multi-tenant SaaS control plane plus a lightweight gateway that sits in the path of agent traffic. Identity, policy and audit in one place, for every agent, model, MCP server and API.

Request an architecture review →View roadmap
Reference architecture

Control at every boundary.

Agents connect through Zeqtrio instead of holding credentials to backends directly. The control plane manages identities and policy; the gateway enforces decisions inline and emits an audit record for every call.

AI agentscopilots · workflows · autonomous
Agent frameworksLangGraph · CrewAI · custom
Usersdelegating identity (SSO)
Zeqtrio gateway + control plane
◎ agent identity
◇ policy engine
⌘ MCP registry
⇄ traffic enforcement
✓ approvals
◈ audit stream
MCP serversinternal & third-party tools
Enterprise APIsREST · GraphQL · existing gateways
LLM providershosted & private models
IdP / SSO (OIDC, SAML)
Secrets manager / vault
SIEM / observability

Conceptual architecture. Planned deployment: Zeqtrio-hosted control plane; gateway available as managed SaaS or deployed in your own cloud so sensitive traffic stays in your network.

Request lifecycle

What happens in the milliseconds between "agent asks" and "API answers."

  1. 01Authenticate the agent

    The agent presents a short-lived credential bound to its registered identity and runtime. No static keys in prompts, code or config.

  2. 02Resolve delegation

    Zeqtrio identifies the human or system the agent acts for and narrows authority to the intersection of user and agent permissions.

  3. 03Classify the action

    The target tool, API operation, arguments and data sensitivity are identified, including MCP tools/call requests.

  4. 04Evaluate policy

    Tenant-scoped rules return allow, deny, scope-down or require-approval, with a human-readable reason.

  5. 05Enforce and broker

    Approved calls are forwarded with just-in-time credentials injected by the gateway. The agent never sees the backend secret.

  6. 06Record the evidence

    A signed decision record links user, agent, tool, resource and policy version, then streams to your SIEM.

Policy as code

Rules your security team can read and your platform team can version.

Express who an agent is, whom it acts for, and exactly what it may do, down to the tool, argument and threshold. Policies live in Git, go through review, and roll out per environment.

policies/finance-agent.yamlillustrative
# policy: finance-agent / prod  (illustrative)
agent: finance-agent
acts_for: user            # on-behalf-of delegation
rules:
  - allow: mcp:erp.invoice.read
    when: user.role in [ap_clerk, controller]
  - allow: payments.transfer
    when: amount <= 5000
    require: human_approval # above threshold
  - deny: mcp:*.export
audit: siem://splunk/agent-decisions
decision.jsonillustrative
// decision record (illustrative)
{
  "decision": "DENY",
  "agent": "finance-agent@acme/prod",
  "on_behalf_of": "j.doe@acme.com",
  "action": "payments.transfer",
  "amount": 48000,
  "reason": "exceeds delegated limit",
  "next": "approval_requested",
  "latency_ms": 4
}
Capabilities

Built for enterprise controls from day one.

Agent identity & lifecycle

Registration, ownership, credential issuance and rotation, environment binding and one-click revocation for every agent.

Fine-grained authorization

RBAC plus attribute- and context-based rules evaluated per request, with on-behalf-of delegation and step-up approval.

MCP governance

Central registry of approved MCP servers and tools, version pinning, per-tool scopes and blocking of unregistered servers.

Credential brokering

The gateway injects downstream secrets just in time from your vault. Agents never hold long-lived API keys.

Audit, analytics & export

Searchable decision history, anomaly flags and export to SIEM and OpenTelemetry pipelines.

Multi-tenant administration

Organizations, projects, environments, SSO and delegated admin, with strict tenant isolation.

Standards alignment

Built on open standards, not a proprietary island.

Zeqtrio is being designed to align with the protocols and frameworks your teams already use.

AUTHOAuth 2.1 & OIDC AGENTSModel Context Protocol authorization WORKLOAD IDSPIFFE-style workload identity DELEGATIONOAuth token exchange (RFC 8693) TELEMETRYOpenTelemetry RISKOWASP Top 10 for Agentic Applications GOVERNANCENIST AI Risk Management Framework
Roadmap

From foundation to pilot.

We're building in the open with design partners. Phases and scope may change based on what they need most.

IN PROGRESSPhase 01

Foundation

  • Cloud infrastructure
  • Tenants, orgs, environments
  • SSO, RBAC, admin portal
NEXTPhase 02

Gateway MVP

  • Agent registration & credentials
  • Policy engine v1
  • MCP proxy & audit log
PILOTPhase 03

Design partners

  • Guided onboarding
  • Security validation
  • Approvals & SIEM export
LATERPhase 04

Scale

  • Self-hosted gateway
  • Policy analytics & anomaly detection
  • Compliance reporting
Design partner program · Limited cohort

Pressure-test the architecture with us.

Bring your agent use case and your hardest security requirement. We'll walk through how Zeqtrio would handle it and build the pilot around what you need.

Apply as a design partner →Email the founder