Gatekeeper

​

What Is Gatekeeper?

Gatekeeper controls which AI services your organisation can access. It decides every service in the service catalogue from a default rule and the requirements you set, and allows or blocks services as people work. It is your access control layer for AI.

​

How It Works

A Gatekeeper decides every service from four parts. Each one wins over the ones before it.

1. The default rule applies to any service nothing else speaks to: allow all or block all.
2. Filters block every service that fails a requirement you set, such as a missing certification or data kept for too long. They keep applying as services join the catalogue or change.
3. Inventory sync allows the services declared in your inventory and follows your declarations as they change. You choose which wins when a declared service fails a filter.
4. A manual adjustment sets one service to Allowed or Blocked by hand. It wins over everything else and stays in place when the other parts would later decide differently.

Every service in the catalogue has one decision per Gatekeeper, and the Services list shows what set it. Before you save, Unsaved changes shows what your edits would block or allow. You define the policy on each Gatekeeper. The organisation default applies everywhere, unless a workspace is assigned a different Gatekeeper.

​

Choose Your Default Rule

​

Filters

A filter is a standing requirement: one field from the catalogue, a condition, and one or more values. A service that fails it is blocked. Filters only block, and a Gatekeeper’s filters all apply together. Under Filters, select Add filter and pick a field. Each row reads Block if, then the field, the condition and the values. A line under the row says how many services in the catalogue match, how many are blocked, and how many Inventory keeps allowed. Most fields offer Not stated as a value, for services whose catalogue entry does not say. A filter catches those services only when you pick it, so nothing is assumed about a service the catalogue is silent on. Filters follow the catalogue as it changes. When a service joins the catalogue or a provider changes its terms, the decision follows, and you can be notified when a change blocks a widely used service or introduces new risk.

​

The Services List

Services lists every service in the catalogue with its decision. The views across the top show All, Blocked, Allowed and Adjusted, each with its count, and you can search by name. Set a service’s status to Allowed or Blocked to adjust it by hand. A manual adjustment wins over filters, Inventory and the default rule, and stays in place when results change. To hand the service back to the rules, select the reset icon on its row.

​

Add your own service

For a domain or a path the catalogue does not cover, select Add your own under the list and enter it, such as chat.example.com or example.com/ai. It is listed under Custom services and takes the opposite of your default rule: blocked under Allow all services, allowed under Block all services. To add a service to the catalogue itself, with a name and a category that every Gatekeeper and your inventory can use, add a custom service in the service catalogue.

​

Inventory Sync

Turn on Inventory sync to keep the services declared in your inventory allowed on this Gatekeeper. When a declaration changes, the configuration follows. Under When Inventory and filters disagree, choose what happens to a declared service that fails your filters:

• Inventory takes precedence: declared services stay allowed.
• Filters take precedence: declared services are blocked.

The card lists the declared services that conflict with your filters, the filters they match, and what happens under the choice you made. This is separate from Sync with Inventory under subscription rules, which follows the subscriptions you declared.

​

Before You Save

The Unsaved changes panel describes what the configuration on screen would do once saved: every service whose decision changes, sorted by how many people used it in the last 30 days, with a count of how many would be blocked. Each row says what causes the change, such as the filter that blocks it. On a new Gatekeeper, the panel shows the result of the whole configuration. The panel warns when:

• A widely used service will be blocked: the share of people using it in the last 30 days is above the usage threshold set under Notifications.
• A change introduces new risk: a service with open risks would be allowed.

Select Review all changes to see and search the full list. Discard returns the Gatekeeper to its last saved configuration. Nothing is recorded until you save, and changes apply as soon as you do.

​

Subscription Rules

Many AI services come with more than one subscription. Subscription rules let you allow a service only on the subscriptions you choose, for example only on the plan your organisation pays for, so work stays on accounts you control. Turn on Subscription rules on a Gatekeeper configuration, select Add service, and tick the subscriptions to allow for each service: Only services with Subscription control can be added. Find them with the Subscription control filter in the service catalogue, or under Agent Capabilities on a service. A subscription rule only narrows a service Gatekeeper already allows. It never allows a blocked service, and an access request exception does not lift a subscription block. Rules apply while the Gatekeeper is an Enforcer.

​

Sync with Inventory

Turn on Sync with Inventory to follow the subscriptions declared in your inventory instead of repeating them on every Gatekeeper. Each declared service with subscription control gets a rule with its declared subscriptions, and the Source column shows Inventory.

• Customise sets a service’s subscriptions on this Gatekeeper instead. The source becomes Custom, and a custom rule always takes precedence over Inventory.
• Revert returns a customised rule to the declared subscriptions.
• When a connection is authorised for a declared service’s provider, Velatir takes the connection to mean your organisation has a company plan for that provider. The rule then allows Company and keeps it while the connection is authorised, whether or not the connection includes a company plan for that particular service. The source shows the connection, and a notice on the rule says what changed. You can still change Private and Free with Customise.

Turning sync off keeps every rule as it stands, as a custom rule.

​

What People See

Subscription rules are applied in the browser extension, version 1.20.0 or later, and in Claude Code, Codex, and Cursor through AI tool coverage. In those tools there is no first-time message: a prompt from a subscription you do not allow is blocked, and the tool shows why.

• The first time someone opens a service with a rule, a message tells them which subscriptions to use, and they acknowledge it. If Coach introduces the service on the same visit, both are in one message, so there is still only one thing to acknowledge. It comes back when you change which subscriptions are allowed. Use the preview under Tell users which subscription to use to see it.
• While Velatir identifies their subscription, a notice says so. They can keep working and send prompts. Each prompt or file upload is checked as it is sent, and if that check shows a subscription you do not allow, it is not sent and a Prompt not sent message names the reason.
• Once Velatir has identified a subscription you do not allow, a message names the subscriptions that are allowed. They can still type, but prompts and file uploads on that subscription are stopped before they leave the browser.
• When the subscription cannot be identified, nothing is blocked.

Subscription blocks are recorded as Gatekeeper assessments on the session, with the subscription used and the subscriptions allowed, and are counted separately from blocks for sensitive content. They work without a Data Protector.

​

Recommended Services

A block does not have to be a dead end. Turn on Recommended services on a Gatekeeper configuration and pick approved alternatives from the catalogue. When someone reaches a blocked service, Gatekeeper can point them to an option you already allow. Tick Include services declared in Inventory to suggest your declared services as well. The list updates as declarations change. Recommended services are per Gatekeeper, so a workspace assigned a different Gatekeeper can suggest different alternatives.

​

Access Requests

When Gatekeeper blocks a service, the person can ask for access and give a reason. The request lands on that Gatekeeper configuration. Turn on User exceptions on the Gatekeeper configuration to allow requests. They are off until you enable them. You can switch them on while you create a new Gatekeeper. Requests and exceptions appear once it is saved. The User exceptions card has two tabs, Requests and Exceptions. Select Respond on a request to open it, then:

• Accept the request, which grants that device an exception for the service
• Decline it
• Revoke a granted exception later from the Exceptions tab

Exceptions stay as narrow as the request that asked for them: they apply to one device, not the whole organisation. The person is told about your decision.

​

Notifications

Use the Notifications card on the Gatekeeper configuration to choose who hears about this Gatekeeper, and about what. Add a Channel (Slack, Microsoft Teams, or Text Message) or an Email recipient. Channels are set up under Settings → Channels. Then, under Notify about, tick the events to send: These cover changes made by an administrator and changes that follow from the catalogue, when a service joins it or a provider’s terms change. Administrators can also follow every change to a Gatekeeper’s allow and block list, from filters, Inventory sync and catalogue updates, with the Gatekeeper changes notification in their personal notification settings.

​

AI Features Inside Other Apps

Some AI services are built into tools people already use. When HubSpot AI is blocked, the Breeze assistant panel stays hidden in HubSpot. Selecting a Breeze button shows the Gatekeeper message on the HubSpot page, with the option to request access. This needs version 1.18.0 or later of the Velatir browser extension.

​

Block Message, Alert Banner, and Language

Edit the Block message people see when a service is blocked, and the Alert banner shown in the middle of the block page alongside it. Both can be written per language, and a preview shows them as they appear in the browser. Language follows the setting under Settings → Browser extension, unless a workspace overrides it. See Configuring agents.

​

Common Setups

​

Working Alongside the Other Agents

Gatekeeper and Data Protector review each trace independently. A trace can pass Gatekeeper’s service check and still be caught by Data Protector for sensitive content. Coach is separate. It guides people and leaves allowing and blocking to the other two.

---