> ## Documentation Index
> Fetch the complete documentation index at: https://docs.velatir.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Gatekeeper

> Control which AI services your organisation can use, in real time.

## What Is Gatekeeper?

Gatekeeper controls which AI services your organisation can access. It enforces your default policy and any explicit exceptions, allowing or blocking services as people work. It is your access control layer for AI.

## How It Works

Gatekeeper is built from two simple parts: a **default rule** that applies to every service, and a list of **exceptions** for the services you want to treat differently. When someone reaches an AI service, Gatekeeper checks it against your policy and acts at once.

You define the policy on each Gatekeeper. The organisation default applies everywhere, unless a workspace is [assigned a different Gatekeeper](/agents/configuring-agents).

## Choose Your Default Rule

<Tabs>
  <Tab title="Allow all services">
    All AI services are allowed unless you explicitly block them. You then add the services you want to **block** as exceptions. This suits organisations that want broad access with a few clear exclusions.
  </Tab>

  <Tab title="Block all services">
    All AI services are blocked unless you explicitly allow them. You then add the services you want to **allow** as exceptions. This suits organisations that want a locked-down, approved-only list.
  </Tab>
</Tabs>

## Add Exceptions

Search the [service catalogue](/insights/service-catalog) and select the services to block or allow. Everything else follows your default rule. You can adjust the list at any time, and changes take effect on the next trace.

## Recommended Services

A block does not have to be a dead end. Turn on **Recommended services** on a Gatekeeper configuration and pick approved alternatives from the catalogue. When someone reaches a blocked service, Gatekeeper can point them to an option you already allow.

Recommended services are per Gatekeeper, so a workspace assigned a different Gatekeeper can suggest different alternatives.

## Access Requests

When Gatekeeper blocks a service, the person can ask for access and give a reason. The request lands on that Gatekeeper configuration.

From the **User exceptions** panel you can:

* **Accept** the request, which grants that **device** an exception
* **Decline** it
* **Revoke** a granted exception later

Exceptions stay as narrow as the request that asked for them: they are per device, not organisation-wide. Open requests and granted exceptions have their own tabs.

Turn access requests on per Gatekeeper configuration. They are off until you enable them.

## Block Message and Language

You can edit the message people see when a service is blocked, including per language. A live preview shows the notification as it appears in the browser. Language follows **Settings → Agents**; see [Configuring agents](/agents/configuring-agents#localisation).

## Common Setups

<AccordionGroup>
  <Accordion title="Open with a blocklist" icon="shield">
    Keep AI broadly available, but block a handful of services you do not trust or have not approved. Good for teams early in their AI adoption.
  </Accordion>

  <Accordion title="Locked down with an allowlist" icon="lock">
    Block everything by default and allow only the services that have passed your review. Good for regulated work and strict vendor policies.
  </Accordion>

  <Accordion title="Suggesting an approved alternative" icon="route">
    When someone reaches a blocked service, point them to an approved alternative that meets the same need.
  </Accordion>
</AccordionGroup>

## Working Alongside the Other Agents

Gatekeeper and [Data Protector](/agents/data-protector) review each trace independently. A trace can pass Gatekeeper's service check and still be caught by Data Protector for sensitive content. [Coach](/agents/coach) is separate: it guides people; it does not allow or block a service.

***

<CardGroup cols={2}>
  <Card title="Service catalogue" icon="book-open" href="/insights/service-catalog">
    Browse the AI services Velatir can detect.
  </Card>

  <Card title="Configuring agents" icon="sliders-horizontal" href="/agents/configuring-agents">
    Defaults, extra Gatekeepers, and workspace assignment.
  </Card>
</CardGroup>