End-to-end traces
Correlate gateway, policy, selected upstream, and outcome metadata without claiming a credential-broker span.
Evidence plane
Trace the decision, not just the HTTP request.
Correlate the current discovery, authorization, upstream execution, and audit path while approval resume, credential use, and full telemetry remain roadmap work.
Product boundary
Request-correlated, redacted audit metadata is available now. OpenTelemetry, SIEM delivery, SLOs, and externally anchored evidence remain roadmap work.
- Available now
- Behavior backed by the current local vertical slice and automated tests.
- Preview
- Useful implementation exists, but the complete operating journey is not proven.
- Planned
- Part of the open MCP-native roadmap, not current product behavior.
- Deployment
- Managed cloud and self-hosted targets share portable packages; live parity remains an acceptance test.
Capabilities
What observability controls
Status labels distinguish tested behavior from useful previews and the open roadmap.
Append-only audit
Record tenant-scoped, redacted identity, policy, target, and outcome metadata in a sequence/hash-linked chain.
Health and SLOs
Measure probe health, latency, error classes, saturation, and connector reliability.
Open export
Export audit configuration today; standards-based trace, metric, and SIEM delivery remains planned.
Operating flow
The target journey, with current maturity called out above.
Correlate
Assign a request identity and carry it through every internal and upstream boundary.
Explain
Record decision inputs, matched policy, route, approval state, and result metadata.
Export
Stream standards-based telemetry without requiring payload collection.
Target control surface
Designed for platform and security teams.
These controls define the intended product boundary; the capability labels above are the current implementation record.
- OpenTelemetry traces
- Structured logs
- Append-only audit events
- SIEM export
- Payload redaction
- Retention policy
Evaluate locally or inspect either deployment target.
The managed cloud and Kubernetes paths are previews of one open codebase, with no intended capability gate or mandatory call-home path.