Capabilities
What AI Gatewarden ships with
The capabilities below are the committed POC feature set — current, shipping functionality, not a roadmap.
Shadow-AI discovery & coding-tool visibility
Surfaces AI usage employees may never report — including the tools that talk to provider APIs in the background.
- Even your AI coding tools are monitored — assistants like the Anthropic CLI, GitHub Copilot, Cursor, Windsurf, and Cline call covered provider domains.
- Even background AI apps running in your system tray are captured via their periodic network calls — minimizing the window doesn't help.
- Employees can't avoid it by using incognito mode; incognito doesn't bypass the network layer.
The "On Patrol" dashboard
A single management view of monitoring health, AI activity, and the evidence log.
- On-Patrol home — at-a-glance monitoring health and uptime, total AI interactions, Low/Medium/High risk breakdown, and recent activity.
- Events list — every AI service interaction with hostname and source IP, the AI service, risk level, and a plain-English classification reason.
- AI System Registry — declare your approved AI tools; unrecognized services are flagged as anomalies, and you can add custom domains.
- Incidents — High-risk events flagged for review: your evidence log.
- Compliance report — exportable, with a risk summary, AI services detected, incident log, and a Monitoring Health section.
- Settings — the configuration and administration area for the appliance.
Tamper-evident evidence trail
An audit log built to stand up to scrutiny: any modification is detectable.
- Hash-chained audit log (JSONL) — alter any record and the chain breaks, so tampering is detectable.
- A queryable SQLite index for fast review, fully rebuildable from the hash-chain source of truth.
Self-healing & monitoring integrity
The product's core trust promise: silent monitoring gaps are unacceptable.
- Autonomous recovery — the appliance detects and restarts crashed components and recovers orphaned network state without human intervention.
- Every self-healing action is logged with timestamp, component, action taken, and gap duration.
- Alerts fire on any monitoring degradation, not only on detected AI events.
- Compliance reports include a Monitoring Health section (uptime and any gaps).
Immediate alerting (Observer Mode)
The right people are told the moment a High-risk AI interaction is logged.
- Immediate email notification when a High-risk event is detected.
- Observer Mode: Gatewarden logs and alerts. It does not block AI requests.
Readable attribution
Logs a human can read, with the technical detail still intact.
- Maps source IP to hostname using DHCP lease data, so every event carries a hostname.
- Source IPs are retained alongside hostnames for technical troubleshooting.