Trusted Gateway
Recorded · replay of 15 October 2026 runs

Verified Agent Transactions

How a payment request travels

Hover or tap any part to see its certificate and what it checks
no connection no connection score lookup + caller's ID PARTNER AGENTS Travel Agent Grok model · no guardrails Identity active Domed Travel Agent Grok model · Dome guardrails Identity active Vijil Identity Server SPIRE · 5-min certs Vijil Console Trust scores by ID Vijil Gateway Policy enforcement Identity certificate (illustrative) Allowed to call the Payment Provider Trust score ≥ 0.70 Payment Provider Payments agent Waiting for a payment
Mutual TLS, both sides verified Certificate from SPIRE Request forwarded to the Payment Provider Identity revoked, certificate still valid Refused or denied

Payment Provider policy

Minimum trust score0.70

Global, set once at the gateway. Agents scoring below it are refused. Changing it rewrites the gateway's live policy.

Run a payment

Scenario

Runs the same message against both agents at once: the Travel Agent with no guardrails, and the Domed Travel Agent behind the Vijil Gateway.

Travel AgentNo guardrails

Conversation

No payment yet

Choose a scenario, then select Run payment.

    Domed Travel AgentVijil Dome guardrails

    Conversation

    No payment yet

    Choose a scenario, then select Run payment.

      Technical log

      Events from the travel agent's payment tool. The Dome check and the model's reply are not in this stream.

      Each response, trust score, and allow or deny decision is real, recorded on 15 October 2026 from the live registered agents on AWS Bedrock AgentCore, the Vijil Console trust scores of their registrations (measured on a separate deployment of the same travel agent), and the Vijil Gateway; this page replays those runs. The agents' SPIFFE identities are assigned but not yet attested. The certificate-issuance and mutual-TLS animation illustrates the real SPIFFE-based architecture; it is not per-request telemetry.