direction (input / output) on the request and response path,
and applies the verdict inline. Findings show up in TrustGuard Activity and as spans on
TrustGate traces.
You do not create or paste a collector API key. The platform authenticates the gateway
to TrustGuard. Other gateways (Portkey, LiteLLM, Kong, …) still use a collector key.
Setup
- In TrustGuard, create a TrustGate collector and bind it to your Agent Gateway (one collector per gateway).
- On that collector, assign a default runtime policy (and optional per-consumer overrides). Without a matching policy, evaluate allows traffic unguarded.
- In TrustGate, add the TrustGuard guardrail (
trustguard) on the routes to protect and select that collector. You can also create the gateway-bound collector from the policy UI when prompted. - Choose enforce or observe, and whether to inspect request, response, or both
(
request/response/request_response). - Send a test request — it should appear in TrustGuard Activity.
collector_id and direction. TrustGuard base URL and credentials
come from the gateway deployment, not the policy form.
See also TrustGate guardrails.
Verdict behavior
On most evaluate transport/timeouts errors the gateway fails open (traffic continues).
Rate-limit and entitlement failures block.