Skip to main content

​
What Is Gatekeeper?

Gatekeeper controls which AI services your organisation can access. It enforces your default policy and any explicit exceptions, allowing or blocking services as people work. It is your access control layer for AI.

​
How It Works

Gatekeeper is built from two simple parts: a default rule that applies to every service, and a list of exceptions for the services you want to treat differently. When someone reaches an AI service, Gatekeeper checks it against your policy and acts at once. You define the policy on each Gatekeeper. The organisation default applies everywhere, unless a workspace is assigned a different Gatekeeper.

​
Choose Your Default Rule

All AI services are allowed unless you explicitly block them. You then add the services you want to block as exceptions. This suits organisations that want broad access with a few clear exclusions.

​
Add Exceptions

Search the service catalogue and select the services to block or allow. Everything else follows your default rule. You can adjust the list at any time, and changes take effect on the next trace.

​
Subscription Rules

Many AI services come with more than one subscription. Subscription rules let you allow a service only on the subscriptions you choose, for example only on the plan your organisation pays for, so work stays on accounts you control. Turn on Subscription rules on a Gatekeeper configuration, select Add service, and tick the subscriptions to allow for each service: Only services with Subscription control can be added. Find them with the Subscription control filter in the service catalogue, or under Agent Capabilities on a service. A subscription rule only narrows a service Gatekeeper already allows. It never allows a blocked service, and an access request exception does not lift a subscription block. Rules apply while the Gatekeeper is an Enforcer.

​
Sync with Inventory

Turn on Sync with Inventory to follow the subscriptions declared in your inventory instead of repeating them on every Gatekeeper. Each declared service with subscription control gets a rule with its declared subscriptions, and the Source column shows Inventory.
  • Customise sets a service’s subscriptions on this Gatekeeper instead. The source becomes Custom, and a custom rule always takes precedence over Inventory.
  • Revert returns a customised rule to the declared subscriptions.
  • When a connection is authorised for a declared service’s provider, Velatir takes the connection to mean your organisation has a company plan for that provider. The rule then allows Company and keeps it while the connection is authorised, whether or not the connection includes a company plan for that particular service. The source shows the connection, and a notice on the rule says what changed. You can still change Private and Free with Customise.
Turning sync off keeps every rule as it stands, as a custom rule.

​
What People See

Subscription rules are applied in the browser extension, version 1.20.0 or later.
  • The first time someone opens a service with a rule, a message tells them which subscriptions to use, and they acknowledge it. If Coach introduces the service on the same visit, both are in one message, so there is still only one thing to acknowledge. It comes back when you change which subscriptions are allowed. Use the preview under Tell users which subscription to use to see it.
  • While Velatir identifies their subscription, a notice says so. They can keep working and send prompts. Each prompt or file upload is checked as it is sent, and if that check shows a subscription you do not allow, it is not sent and a Prompt not sent message names the reason.
  • Once Velatir has identified a subscription you do not allow, a message names the subscriptions that are allowed. They can still type, but prompts and file uploads on that subscription are stopped before they leave the browser.
  • When the subscription cannot be identified, nothing is blocked.
Subscription blocks are recorded as Gatekeeper assessments on the session, with the subscription used and the subscriptions allowed, and are counted separately from blocks for sensitive content. They work without a Data Protector. A block does not have to be a dead end. Turn on Recommended services on a Gatekeeper configuration and pick approved alternatives from the catalogue. When someone reaches a blocked service, Gatekeeper can point them to an option you already allow. Recommended services are per Gatekeeper, so a workspace assigned a different Gatekeeper can suggest different alternatives.

​
Access Requests

When Gatekeeper blocks a service, the person can ask for access and give a reason. The request lands on that Gatekeeper configuration. Turn on User exceptions on the Gatekeeper configuration to allow requests. They are off until you enable them. You can switch them on while you create a new Gatekeeper. Requests and exceptions appear once it is saved. The User exceptions card has two tabs, Requests and Exceptions. Select Respond on a request to open it, then:
  • Accept the request, which grants that device an exception for the service
  • Decline it
  • Revoke a granted exception later from the Exceptions tab
Exceptions stay as narrow as the request that asked for them: they apply to one device, not the whole organisation. The person is told about your decision.
On devices connected to your organisation’s directory, the name on the request form is filled in from the directory and cannot be edited. Those requests carry a Directory badge in the request list, and the response dialog shows the directory email.On other devices, the name is optional and typed in by the person making the request.
Use the Notifications card on the Gatekeeper configuration to choose who hears about new requests. Add a Channel (Slack, Microsoft Teams, or Text Message) or an Email recipient. Channels are set up under Settings → Channels.The notification includes the service and the reason given, and links to the Gatekeeper configuration where you respond. It leaves out who made the request.

​
AI Features Inside Other Apps

Some AI services are built into tools people already use. When HubSpot AI is blocked, the Breeze assistant panel stays hidden in HubSpot. Selecting a Breeze button shows the Gatekeeper message on the HubSpot page, with the option to request access. This needs version 1.18.0 or later of the Velatir browser extension.

​
Block Message, Alert Banner, and Language

Edit the Block message people see when a service is blocked, and the Alert banner shown in the middle of the block page alongside it. Both can be written per language, and a preview shows them as they appear in the browser. Language follows the setting under Settings → Browser extension, unless a workspace overrides it. See Configuring agents.

​
Common Setups

Keep AI broadly available, but block a handful of services you do not trust or have not approved. Good for teams early in their AI adoption.
Block everything by default and allow only the services that have passed your review. Good for regulated work and strict vendor policies.
When someone reaches a blocked service, point them to an approved alternative that meets the same need.
Allow a service only on Company with subscription rules, so prompts Velatir identifies as sent from a personal or free account are stopped. A subscription Velatir cannot identify is not blocked.

​
Working Alongside the Other Agents

Gatekeeper and Data Protector review each trace independently. A trace can pass Gatekeeper’s service check and still be caught by Data Protector for sensitive content. Coach is separate. It guides people and leaves allowing and blocking to the other two.

Service catalogue

Browse the AI services Velatir can detect.

Configuring agents

Defaults, extra Gatekeepers, and workspace assignment.