> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# TrustGate

> Native TrustGuard collector — bind a TrustGate collector and enable the TrustGuard policy on routes. No API key.

[TrustGate](/trustgate/overview) is the **native** TrustGuard collector. The gateway calls
TrustGuard for you, sets `direction` (`input` / `output`) on the request and response path,
and applies the verdict inline. Findings show up in TrustGuard **Activity** and as spans on
TrustGate traces.

You do **not** create or paste a collector API key. The platform authenticates the gateway
to TrustGuard. Other gateways (Portkey, LiteLLM, Kong, …) still use a collector key.

## Setup

1. In TrustGuard, create a **TrustGate** collector and bind it to your Agent Gateway (one
   collector per gateway).
2. On that collector, assign a **default** runtime policy (and optional per-consumer
   overrides). Without a matching policy, evaluate allows traffic unguarded.
3. In TrustGate, add the **TrustGuard** guardrail (`trustguard`) on the routes to protect
   and select that collector. You can also create the gateway-bound collector from the
   policy UI when prompted.
4. Choose **enforce** or **observe**, and whether to inspect request, response, or both
   (`request` / `response` / `request_response`).
5. Send a test request — it should appear in TrustGuard **Activity**.

Policy settings are only `collector_id` and direction. TrustGuard base URL and credentials
come from the gateway deployment, not the policy form.

See also [TrustGate guardrails](/trustgate/policies/guardrails#trustguard).

## Verdict behavior

| TrustGuard `status` | **Enforce**                                                                    | **Observe**            |
| ------------------- | ------------------------------------------------------------------------------ | ---------------------- |
| `block`             | Deny request or response                                                       | Log; traffic continues |
| `transform`         | Forward masked/rewritten payload (if rewrite cannot be applied safely → block) | Log only; no rewrite   |
| `report` / `allow`  | Continue                                                                       | Continue               |

On most evaluate transport/timeouts errors the gateway **fails open** (traffic continues).
Rate-limit and entitlement failures **block**.