Security and RBAC

Agent Gateway uses Personal Access Tokens, Dataset policies, and My Relewise permissions to decide whether a request is allowed.

Permissions

Agent Gateway has two Dataset permissions.

Permission	What It Allows
Manage Agent Gateway	View and update Agent Gateway settings for a Dataset. This permission also includes Use Agent Gateway.
Use Agent Gateway	Use Personal Access Tokens to access the Dataset through Agent Gateway.

Users with the Administrator role have access by default.

Members do not get Agent Gateway permissions by default. An Administrator or a user with Manage Members can grant the relevant permissions.

Authentication

Agent Gateway uses bearer-token authentication.

Send the Personal Access Token in the Authorization header:

Authorization: Bearer <personal-access-token>

The token identifies the My Relewise user who created it. Agent Gateway verifies that the user still exists and is enabled.

Authorization Gates

Agent Gateway validates every external request before it reaches the requested capability.

The request is allowed only when all of these checks pass:

1. The Personal Access Token exists and is valid.
2. The token is not expired or revoked.
3. The token secret matches the stored token hash.
4. The token is available for the requested Dataset.
5. The requested transport is enabled for Agent Gateway.
6. The Dataset exists.
7. The user has Use Agent Gateway for the Dataset.
8. Agent Gateway access is enabled for the Dataset.
9. The requested transport is enabled for the Dataset.
10. The requested area is enabled for the Dataset.

If a check fails, Agent Gateway blocks the request and records the failure reason in the request log.

Public Routes

When Agent Gateway is accessed through My Relewise, public routes are exposed under https://my.relewise.com/agents.

Use https://my.relewise.com/agents/ to open the interactive API reference for Agent Gateway REST APIs.

Use https://my.relewise.com/agents/{Dataset ID}/mcp when connecting an MCP client. The MCP client discovers available tools after it connects.

Internal Agent Gateway routes are not exposed through the My Relewise reverse proxy.