If a support agent moves money, it needs a gate.
Support and payment agents read unverified requests all day and work with your Stripe, Zendesk or CRM keys. AvertGate decides on refund, payment and email calls before they run.
Decision flow
The refund was not issued
stripe.refundamount: 9000- Amount exceeds the upper limit
- Tool is on the allow list
- Decision written to the record
Every ticket can be an instruction.
One line hidden in a customer message, email or ticket can steer an agent into issuing a refund or sending card details out.
Set a ceiling
Set an amount limit on refunds and payments; above it they are blocked or sent to approval.
Leave approval to a human
Mid-range amounts wait for an approver in Slack; if time runs out, nothing happens.
Scan the exit
Outgoing email is scanned for card numbers and secrets, and recipients are limited to allowed domains.
See it. Limit it. Prove it.
Limit refunds and payments.
Support and finance agents read unverified requests all day and use your Stripe, Zendesk or CRM keys. Because they touch money and customer data, a mistake is costly.
- Refund ceiling. Under the limit passes on its own, the middle band waits for a human, above it is blocked.
- Double check on money. Large refunds and payments ask for approval in Slack. If time runs out, the transaction isn't made.
- Outgoing email scanning. Scanned for card numbers, phone numbers and secrets; recipients can be limited to allowed domains.
Overview
Every call in the live stream.
Take the rules out of code.
Allow, limit and approval rules per tool and argument live in a single YAML file. A change needs no redeploy.
- Deny by default. A tool that is not listed does not run.
- Argument limits. Fields such as amount, SQL and URL are bound to a rule.
- Human approval. Risky calls wait for approval in Slack.
Policy editor
The rule is written on one screen.
Every decision is recorded.
The decision, reason and rule id are linked with SHA-256; a record changed afterwards is detected.
- Reasoned decision. Every event carries the reason and rule id.
- Redacted arguments. Raw data never reaches the dashboard.
- Session trail. Calls in the same session are read together.
Session trails
Every session is traced end to end.
Overview
Watch refund and payment decisions live.
Frequently asked
Do I need a Stripe or Zendesk integration?
No. AvertGate sits in front of tools called over MCP; you write the rule under whatever the tool is called.
What happens if approval times out?
Nothing is executed. The decision and reason are written to the record.
Does customer data go to the cloud?
No. Scanning happens in the Data Plane in your network; only redacted events reach the dashboard.
Guarantees
Four fixed principles behind every decision.
- 3 decisionsEvery call ends in allow, block or human approval.
- Fail-closedIf a check errors, the call is not run.
- SHA-256 chainEvents are chained, so any change after the fact is noticed.
- Your data stays with youTool calls and results never leave your network.
Put a gate in front of your agents.
Every deployment starts with a demo and a POC on your own agents.