Turn on Gate the way you turned on MFA

A regional IT services firm onboards a new analyst on a Monday. By lunch she has a laptop, a company login, a VPN profile that connects before she opens anything else, and an authenticator app she was asked to set up before she could read her email. Nobody held a meeting about any of it. Those controls were decided once, years ago, and they have applied to every hire since. The same afternoon she installs a coding agent and a research agent, points them at a client’s repository and a client’s shared drive, and starts work. Those two agents arrive with no equivalent. No screening on what they read, no cap on what they spend, no record of what they did that anyone outside the tool could check.

That contrast is the whole argument of this post. Services firms and the enterprises they serve already know how to run a security control that nobody has to remember. The AI layer is simply the one place they have not applied the pattern yet.

What MFA taught every IT department

Multi-factor authentication won because of how it was deployed, as much as what it does. It became an organization-wide default, enforced from the top, invisible once set, and effective against a whole class of attacks without asking anyone to understand them. Microsoft’s research team measured the effect across a large population of commercial accounts and found that enabling MFA reduced the risk of compromise by 99.22 percent across the whole population studied, and by 98.56 percent even where credentials had already leaked. The study is from 2023 and covers accounts that were already showing suspicious activity, so treat it as the shape of the result rather than a universal constant. The shape is what matters. A control that is switched on once and left on quietly outperforms any amount of training, reminders, and good intentions.

VPN and endpoint policy followed the same path. A firm decides where traffic goes and what a device is allowed to do, and then it stops being a decision. An employee connects to the VPN every morning without choosing to, because that is simply the way the company’s traffic travels.

AI agents today are where email was before MFA. Each one runs on whatever key the person who installed it happened to use, reads whatever it is pointed at, and keeps its own idea of a log. Prompt injection, the attack where instructions hidden in an email, a document, or a web page redirect an agent into doing something its operator never asked for, sits at LLM01 on the OWASP Top 10 for LLM applications. OWASP’s own mitigation list leans on filtering input and output, least-privilege access, and segregating untrusted content, which is exactly the kind of thing an organization is bad at asking each individual to do by hand and good at enforcing once for everyone.

The control layer, as a default

The missing piece is a single point in the request path that every agent’s traffic passes through, where the firm’s rules apply whether or not the person running the agent thought about them. Screen what goes in. Redact what comes out. Cap what it can spend. Write the record somewhere the tool cannot edit. Then leave it running.

Constellation Gate AI is that layer, and it was built to be switched on the way MFA is switched on. For a desktop fleet, the Gate Connect menu-bar app finds the supported agents already installed on a machine and routes each one through Gate with one click, and it ships with a command-line version so an IT team can script the rollout across a company instead of walking desk to desk. For applications, it is one base URL change in the SDK. Existing tools and subscriptions keep working; a team’s coding agents carry on billing the way they already do. On the Enterprise plan an administrator can force compression and security settings for the whole organization and its teams, so the control applies to every seat rather than to the seats that remembered to configure it. Spend, token, and rate limits can be set at the organization, team, user, or key level, which means a looping agent stops at a number the firm chose instead of at the credit card limit.

Once it is on, every request is screened for injection attempts. Our engineering team published the methodology across 16 public benchmarks and 12,111 samples, using one global threshold rather than one tuned per dataset, and at a strict one-in-a-hundred false-alarm cap it catches roughly 95 of every 100 injection attempts with a median added latency of 53 milliseconds (report and methodology). The false-alarm figure matters more than it sounds. A control that blocks legitimate work gets turned off, the same way an MFA policy that locked people out every morning would have been abandoned. The scope is worth stating precisely, too. Gate controls data exposure to untrusted models, meaning the client material, personal data, and credentials moving through prompts and tool calls. How a model behaves once it has a clean request is a different problem with different answers, and screening reduces this class of risk without removing it.

The part MFA never offered

Here the analogy breaks in Gate’s favor. MFA costs an organization something: a few seconds per login, a help desk queue for lost phones, licenses for the authenticator. Gate’s default path pays the firm back on every request it handles.

Compression and caching are on for every organization from the first request. Repeated content is sent once and referenced afterward, and a request Gate has already answered is served from the stored response rather than billed again. The claim we are comfortable making is 20 percent or more fewer tokens for the same prompt and the same answer, though results vary by workload. Rocket Resume, a resume builder where nearly every session calls a model, routed roughly $40,000 a month of token spend through Gate without changing application code and measured a 23 percent reduction against its own provider invoices (case study). Nobody on their team had to tune anything. The saving arrived because the layer was in the path.

The audit trail works the same way. Every request emits an event that is hash-chained and anchored to Constellation’s Digital Evidence layer, which means a client, an auditor, or a regulator can check the record without taking our word for it. For firms whose clients fall under Article 12 of the EU AI Act, which requires high-risk systems to record events automatically over their lifetime and comes into force on 2 December 2027 for Annex III systems, that record exists from the day the layer is switched on rather than from the day someone starts a logging project.

Why this is a reseller’s product

I wrote last month about running the layer before you sell it. The MFA framing explains why the sale is easier than it looks. Every client a services firm serves has already bought this pattern once. Their security lead rolled out MFA, their IT lead enforced the VPN, and both of them know what a control that runs without attention is worth. Pitching a governance roadmap asks a client to start a project. Pitching Gate asks them to approve a default, the same category of decision they made about MFA, with the difference that this one also trims the bill it governs.

Under our reseller program a firm provisions client organizations inside Gate, bills them directly, and keeps the relationship it already owns, with no minimum commitment. The monthly conversation changes from “here is a slide about what you should do” to “here is what your agents did, here is what it cost, here is what we blocked, and here is the record if anyone asks.” A firm that administers that default for a client is as hard to displace as the firm that administers their identity provider.

The agents are already inside the building. The question is whether they run under a control that someone has to remember, or under one that was decided once and applies to everyone. Set the default and let it run. Injection screening, secret redaction, spend caps, and a tamper-evident record, switched on once for every agent your firm and your clients operate. Free to start.