DeepintShield has a free Developer plan and two paid self-service plans, Team and Business. You can start on Developer and upgrade at any time from inside the app. This is what each plan gives you in plain words.

1.1 What Team adds on top of Developer

• Unlimited guardrail policies and model-backed safety checks configured under AI Models for prompt injection, jailbreaks, toxicity and personal data.
• Partner safety providers: AWS Bedrock Guardrails, Google Model Armor, Azure Content Safety, or your own webhook.
• Cost savings: semantic cache, cheap-first routing, prompt compression, RAG trimming and summarization. Provider prompt caching, request coalescing and the guardrail cache are on every plan, including Developer.
• Model routing rules and the Load Balancer (adaptive routing) across provider keys.
• RAG security: filter the documents your AI reads before they reach the model.
• Agentic policy configuration: configure external context policies, author task scopes and inspect recorded activity. Governed execution requires the runtime availability described in section 11.
• Save your work in the Playground: prompts, sessions and versions. Running prompts without saving works on every plan.
• Alerts to e-mail, Slack or a webhook. Log exports to S3, GCS, BigQuery or Snowflake.
• 30-day log history, 10 seats, 100 virtual keys.

1.2 What Business adds on top of Team

• Full agent security: agent registry and identities, customer-authorized identity provisioning, tool integrity checks, tool grants, blueprint code scans, enrolment policies and AI bill of materials (AIBOM) export. Export signing requires deployment configuration.
• Human-in-the-loop approvals: risky agent actions wait for a person to approve them.
• Agentic access controls: Guided access, temporary delegation, the Enforcing/Advisory switch and blueprint protection, and the Advanced relationships editor.
• Agentic observability: run and authorization evidence, with optional deployment-managed OpenTelemetry or Langfuse export.
• Agentic Cache reporting for cache reuse and savings; governed MCP tool results remain uncached.
• Accuracy controls: all three Hallucination Control tabs and all three Consistency tabs (golden answers, request trace).
• OWASP Agentic Top-10 checks and 7 industry domain packs (banking, healthcare, insurance, enterprise copilot, customer support, development assistant, agentic runtime).
• Monitoring integrations: OpenTelemetry, Prometheus and Grafana.
• 90-day log history, 30 seats, 500 virtual keys, 25 workspaces.

2.1 Create your account

1. Open https://app.deepintshield.com in your browser. You will see the sign-in page.
2. Click the Create account tab on the right.
3. Type your first name, last name, organization name and choose your industry.
4. Type your work e-mail address, create a password and type it again under Re-enter password. The password needs 8 or more characters, one capital letter, one number and one special character.
5. Tick the box to confirm you are 18 or older and agree to the Terms and Privacy Policy.
6. Click Create account.

2.2 Verify your e-mail

1. Open your e-mail inbox and find the message from DeepintShield.
2. Click the verification link in the e-mail.
3. You will return to the sign-in page with the message "Email verified". Type your e-mail and password, tick the box to agree to the Terms and Privacy Policy, then click Sign in. The button stays off until the box is ticked.

2.3 Your first look at the app

After you sign in you land on the Analytics → Overview dashboard. The left menu is the same on every page. Here is what each part does.

2.4 The setup checklist

A Continue setup button sits at the top right of the page, in the top bar. It opens a 7-step checklist that covers the same setup as sections 3, 5, 6 and 8 of this guide. Each step has a Go to step button that takes you to the right page, and a Mark done link.

Think of it like folders: a tenant is the big folder (for example "Production"), and a workspace is a folder inside it (for example "Support bot"). Everything you create later belongs to one workspace. A new account starts with one tenant and no workspace, so create a workspace first.

3.1 Create a tenant

1. In the left menu open Governance Hub → Tenants.
2. Click New tenant (top right).
3. Type a name, for example Production, and an optional description.
4. Click Create tenant. The new tenant appears in the list and under Tenants in the switcher at the top of the left menu.

3.2 Create a workspace

1. Open Governance Hub → Workspaces.
2. Click New workspace.
3. Type a name, for example Support bot. The tenant is filled in for you.
4. Click Create workspace. It becomes your active workspace right away.

3.3 Switch tenant or workspace

Use the switcher at the top of the left menu, just under the logo. It shows the tenant and workspace you are in, as Tenant / Workspace. Click it to open one menu with two lists. To change tenant, pick one under Tenants. The menu stays open and the second list changes to the workspaces in that tenant. To change workspace, pick one from that second list. Every page then shows that workspace's data. The gear icon next to each list opens the Tenants or Workspaces page in Governance Hub.

3.4 Invite people to the app

People who need to sign in to the DeepintShield app are added in Governance Hub → User Manager. (End users of your application are different; they are "Members" in section 6.)

1. Open Governance Hub → User Manager and click Add user.
2. Type the person's e-mail address.
3. Choose a role for the current workspace: Admin can manage workspace settings, providers and governance, but not users; Viewer can only look at dashboards, logs and traces.
4. Click Send invitation. They receive an e-mail with a link to create their password.

Only the person who created the organization (the owner) can change the plan. Upgrades happen inside the app and take effect immediately after payment.

4.1 Open the plan window

1. Look at the bottom of the left menu. On the free plan you see a Developer badge with Upgrade plan next to it. On a paid plan it reads Manage plan.
2. Click it. The plan window opens with three cards: Developer, Team and Business.

4.2 Choose currency and billing period

1. At the top right of the window pick USD or INR. If you pay with an Indian card choose INR; Indian cards cannot be charged in USD.
2. Pick Monthly or Annual. Annual saves about 17% (you pay for 10 months).
3. Read the card for the plan you want. The prices update as you switch.

4.3 Accept the terms and pay

1. Tick the box I have read and agree to the Terms and Conditions and Privacy Policy. The upgrade buttons turn on only after you tick it.
2. Click Upgrade to Team or Upgrade to Business.
3. A secure payment window (Razorpay) opens. Enter your card details and confirm. Do not close the browser tab while it processes.
4. When payment succeeds the window closes, the plan badge at the bottom of the left menu changes to Team or Business, and every feature of the plan is switched on. A signed PDF copy of the agreement is e-mailed to you.

4.4 See and manage your billing

Open Account Settings (in the RESOURCES group of the left menu) and click the Billing tab. Here you can see your plan, the next billing date, request usage, seats and the projected total. Use Manage payment to open the plan window and Cancel subscription to stop renewing. A downgrade takes effect at the end of the current billing period, so you keep what you paid for.

4.5 Monthly extras: requests over the allowance and extra seats

Your plan price covers a monthly request allowance and a number of seats. Anything above that is billed separately as monthly extras, after the month ends. There is no logging fee and no markup on what you pay your AI providers.

1. On the Billing tab, the Monthly usage card shows this month's requests against your allowance, your current seat count, the unit prices and an estimate of the extras including tax. The estimate is not a bill; it reads zero until your first paid month has been recorded.
2. After the month ends the invoice appears in the invoice list. Click Pay on its row to pay through a secure Razorpay link. An invoice for zero is marked paid automatically.
3. Indian customers can switch on Enable AutoPay instead. You approve a separate UPI mandate with a per-invoice limit (INR 15,000 by default, or a lower amount you choose) and each month's extras are collected automatically. The mandate lasts one year. Invoices above your limit still come as a payment link.
4. Paying an extras invoice never changes your plan. If you cancel, the base plan stops renewing but extras already used remain payable.

4.6 If an invoice is not paid

Using more than your allowance never switches your account off; only an unpaid invoice does, and only after reminders. The Billing tab shows the outstanding amount, the due date and any restriction that is in force.

A provider is a company whose models you call, for example OpenAI, Anthropic, Google Gemini or AWS Bedrock. You give DeepintShield the provider's API key once; your applications then use a DeepintShield Virtual API Key instead and never see the real provider key.

5.1 Add a provider key

1. Open Model Hub → AI Providers.
2. In the provider grid click the provider you want, for example OpenAI. A green tick marks providers that are already added to this workspace.
3. Click Add new key (top right).
4. Give the key a name, paste the provider API Key, and optionally choose which Models this key may serve. Leave Weight at 1 unless you add several keys and want to split traffic.
5. Leave Use for Cache on so cached answers can be served for this key.
6. Click Save. The key appears in the Configured keys table with an Enabled switch.

5.2 Add a custom or self-hosted provider

Running your own model server such as vLLM, Ollama or SGLang? Click Custom at the top of the provider grid, give it a name, choose the Base Format it speaks (usually OpenAI-compatible), enter its Base URL, switch on Is Keyless if it needs no key, and leave the allowed request types on. Then add a key exactly as above if one is needed.

5.3 Model Registry

Model Hub → Model Registry opens the Model Catalog page. It shows one card for each provider you have connected, with the models used in the selected period, the number of requests and the cost. Totals for providers, models, requests and cost are at the top. Use it to see which models your applications are calling. Models are called as provider/model, for example openai/gpt-4o-mini; a bare name like gpt-4o-mini also works and is resolved from the gateway's model catalog.

5.4 Usage Controls (rate limits and budgets per model)

Set a request limit or spend limit on a specific model so one busy app cannot run up your bill.

1. Open Model Hub → Usage Controls and click Add Model Limit.
2. Choose the provider and model, then set requests or tokens per minute/hour/day and, if you like, a monthly budget.
3. Click Create Limit.

5.5 Price Adjust and Model Overrides

Price Adjust applies a multiplier to the prices of one provider, which you pick under Integration, so the cost shown in your dashboards matches what you actually pay or charge internally: 1.0 leaves it unchanged, 0.8 is a 20% discount, 1.2 is a 20% mark-up. Model Overrides sets your own price for one model: the input and output cost in USD per 1,000,000 tokens. Use it when your negotiated rate differs from the provider's list price.

5.6 Model Routing rules

Routing rules send a request to a different model or provider based on a condition, such as the user, a header or the model name. Open Model Hub → Model Routing, click New Rule, add one or more conditions, pick the Target model and an optional Fallback, then Save Rule.

5.7 Load Balancer

Access & Credentials → Load Balancer shows how traffic for each Virtual API Key is spread across provider keys and whether each key is healthy. Click the gear icon on a row to change the strategy (weighted random, round robin or least load).

A Virtual API Key (VK) is the key your application uses. It is tied to one workspace, to the providers you allow, to a budget and to safety policies. Members are the end users or applications you want to track and limit; Teams group members and share a budget.

6.1 Add a member

1. Open Access & Credentials → Members and click Add Member.
2. Type a name (for example billing-app or a person's e-mail).
3. Optionally set a monthly budget and a rate limit (per hour or per month).
4. Click Create Member.

6.2 Create a team

1. Open Access & Credentials → Teams and click Add Team.
2. Name the team and add the members you created.
3. Optionally set a shared team budget. Click Create Team.

6.3 Create your Virtual API Key

1. Open Access & Credentials → Virtual API Keys and click Add Virtual Key.
2. Type a Name, for example support-bot-prod.
3. Under Guardrail Policies pick the safety policies this key must follow (you can come back after section 8).
4. Leave Automatic Cache and Semantic Cache on to save money on repeated questions.
5. Under Key Rotation keep the default (a new key value every 90 days with a 7-day grace period) or choose Manual only.
6. Scroll down: add the providers this key may use (and optional fallback order), any MCP clients, a budget and rate limit, and assign the key to a member or team.
7. Click Create. The key appears in the table, masked. Use the copy button in the Key column to copy the value that starts with sk-ds-, and store it safely.

6.4 Send your first request

Use your new key exactly like a provider key, but point your client at DeepintShield. Here is a request from the command line:

curl https://app.deepintshield.com/v1/chat/completions \
  -H "Authorization: Bearer sk-ds-your-virtual-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-4o-mini",
    "messages": [{"role": "user", "content": "Say hello in one sentence."}]
  }'

You get a normal OpenAI-style JSON answer. The request also appears in Analytics → AI Logs within a few seconds, with its status, model, latency, cache result and guardrail decision. The Tokens and Cost columns start hidden: click Columns to show them.

These examples target Python SDK 3.2.3, compatible with DeepintShield Server 3.2.3. Use a build containing the current identity provisioning updates; version metadata alone does not establish which updates your gateway has deployed.

The deepintshield Python package is the easiest way to route your code through the gateway and to call guardrails, RAG security, MCP tools and agent governance directly. It works with Python 3.10 or newer. All examples below use your Virtual API Key from section 6.

7.1 Install

pip install --upgrade "deepintshield==3.2.3"

# add only the integrations you use, for example:
pip install --upgrade "deepintshield[openai]==3.2.3"
pip install --upgrade "deepintshield[openai,anthropic,langgraph,mcp]==3.2.3"

7.2 Tell the SDK about your key

Set one environment variable. The SDK reads it automatically and talks to app.deepintshield.com by default.

export DEEPINTSHIELD_VIRTUAL_KEY="sk-ds-your-virtual-key"
# optional, only for a self-hosted gateway:
# export DEEPINTSHIELD_BASE_URL="https://gateway.your-company.com"

7.3 Your first guarded chat call

from deepintshield import DeepintShield

with DeepintShield.from_env() as shield:
    with shield.openai() as client:              # native OpenAI client, routed through DeepintShield
        response = client.chat.completions.create(
            model="openai/gpt-4o-mini",
            messages=[{"role": "user", "content": "Hello"}],
        )
        print(response.choices[0].message.content)

The gateway applies your configured guardrails, budgets, logging and eligible caching to this call. For models that need Responses, use client.responses.create(...); changing the model name does not change the API method. Section 7.5 shows GPT-6 Astra.

Use the OpenAI client as the primary inference client across all 29 gateway providers. Change the provider/model request argument, for example anthropic/claude-sonnet-4-5, while keeping the same virtual key and base URL. Provider keys and cloud configuration stay on the gateway. Use the operation the model supports: text, embeddings, images, audio, or video. Model inventory and account access determine availability.

The SDK also exposes shield.async_openai() and shield.openai_config(). Native frameworks keep orchestration: LangChain/LangGraph keep graphs, LlamaIndex keeps retrieval and indexing, and existing Agentic identity and tool policies still apply. Install and test only the framework extras used by your application; current optional dependencies may require separate environments.

7.4 The unified chat helper

For a model that supports Chat Completions, use shield.chat(...). This helper sends Chat Completions requests; it does not switch to Responses based on the model name. Streaming is one extra argument.

from deepintshield import DeepintShield

shield = DeepintShield.from_env()

# one-shot answer as a dictionary
answer = shield.chat(
    model="openai/gpt-4o-mini",
    messages=[{"role": "user", "content": "Give me three tips for writing clear e-mails."}],
    temperature=0.2,
)
print(answer["choices"][0]["message"]["content"])

# streaming: print each chunk as it arrives
with shield.chat(model="openai/gpt-4o-mini",
                 messages=[{"role": "user", "content": "Explain caching in two lines."}],
                 stream=True) as stream:
    for chunk in stream:
        print(chunk)

7.5 Keep your existing OpenAI code

You can use the native OpenAI SDK directly. Point it at DeepintShield and use your sk-ds- key. Provider-qualified model names select any supported gateway provider:

import openai

client = openai.OpenAI(
    base_url="https://app.deepintshield.com/openai",     # was https://api.openai.com/v1
    api_key="sk-ds-your-virtual-key",              # was your OpenAI key
)
print(client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello"}],
).choices[0].message.content)

For GPT-6 Astra, use the native Responses API. Astra requires Responses when function tools are present and does not support reasoning_effort="none". A virtual key's MCP bindings can add tools even when your Python call has no tools argument. The same responses.create method works on the client returned by shield.openai().

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://app.deepintshield.com/openai",  # local: http://localhost:8080/openai
    api_key=os.environ["DEEPINTSHIELD_VIRTUAL_KEY"],
)
response = client.responses.create(
    model="gpt-6-astra",
    input="Hello",
    reasoning={"effort": "medium"},
    max_output_tokens=2048,
)
print(response.output_text)

Responses uses input instead of messages, max_output_tokens instead of max_completion_tokens, and reasoning={"effort": "medium"} instead of reasoning_effort. Read response.output_text instead of response.choices[0].message.content. Keep function results and returned reasoning items in the Responses continuation when implementing a tool loop.

import anthropic

client = anthropic.Anthropic(
    base_url="https://app.deepintshield.com/anthropic",
    api_key="sk-ds-your-virtual-key",
)
message = client.messages.create(
    model="claude-sonnet-4-5",
    max_tokens=200,
    messages=[{"role": "user", "content": "Hello"}],
)
print(message.content[0].text)

The Anthropic example is an optional provider-native path for features needing Anthropic's protocol. The same role applies to shield.bedrock() and shield.genai(). Keep OpenAI as the primary common inference client, and validate optional native features after that path. Framework binders retain native orchestration and do not remove enrollment or tool-approval requirements.

7.6 Check a prompt against your guardrails yourself

Sometimes you want the safety verdict without sending the prompt to a model, for example before saving user text. Ask the guardrails directly:

result = shield.evaluate_guardrail(
    stage="input",                       # input | output | action | mcp | rag
    input="Please summarize this support ticket",
    model="gpt-4o-mini",
    provider="openai",
    metadata={"ticket_id": "T-100"},
)
print(result.decision, result.reason, result.mode)
if result.blocked:
    print("This text is not allowed by policy")

# the same idea for agents: check what goes in, what a tool is about to do, what comes out
shield.agent.check_input("user message")
shield.agent.evaluate_tool(name="ledger_read", args={"account": "A-7"}, action_class="read")
shield.agent.check_output("assistant response")

Blocked calls show up in AI Guardrails → Findings (section 8).

7.7 Protect what your AI reads (RAG security)

If your app looks up documents and puts them in the prompt (RAG), authorize document access in your application, then send the authorized pieces to DeepintShield for content safety checks. Only pieces allowed by that safety policy come back. SDK 3.2.3 does not accept the former acl_tags argument; RAG safety checks do not grant document access.

from deepintshield import build_chunk

chunk = build_chunk(
    content="Refunds take five business days.",
    chunk_id="chunk-17",
    document_id="refund-policy",
    source_id="support-kb",
    trust_score=95,
)

allowed, raw = shield.rag.filter(
    query="How long do refunds take?",
    chunks=[chunk],
    source_id="support-kb",
    requester="alice@example.com",
    requester_role="support",
)
# use only `allowed` when you build the prompt

# LangChain / LlamaIndex users: wrap the retriever once and forget about it
retriever = shield.rag.guard_retriever(vectorstore.as_retriever(), source_id="support-kb")
documents = retriever.invoke("How long do refunds take?")

7.8 Call MCP tools through the gateway

Register your MCP servers in Agentic → MCP Registry (section 10). Your code then opens one governed session and every tool call is checked and logged.

Use the exact gateway-qualified tool name returned by discovery and arguments that match its input schema. An empty tool list is valid: the session currently exposes no tools. Check the DeepWiki connection in Agentic → MCP Registry, then select it and its tools under Virtual Keys → MCP Client Configurations → Allowed Tools for the key used by this script. This example checks every discovery page before calling DeepWiki. A listed tool still needs authorization when called.

The SDK reports valid remote tool-call rejections as mcp_execution_failed and discovery failures as mcp_discovery_failed; malformed responses remain mcp_protocol_error. Canonical policy and approval codes remain unchanged.

import asyncio

from deepintshield import DeepintShield, DeepintShieldError
from mcp.types import TextContent

shield = DeepintShield.from_env()


async def main() -> None:
    try:
        # The yielded object is an initialized official mcp.ClientSession.
        async with shield.mcp.connect() as session:
            listing = await session.list_tools()
            tool_names = {tool.name for tool in listing.tools}
            while listing.nextCursor:
                listing = await session.list_tools(cursor=listing.nextCursor)
                tool_names.update(tool.name for tool in listing.tools)
            print(sorted(tool_names))

            tool_name = "DeepWiki-ask_question"
            if tool_name not in tool_names:
                print("DeepWiki is unavailable for this virtual key. Check its MCP configuration and allowed tools.")
                return

            result = await session.call_tool(
                tool_name,
                arguments={
                    "repoName": "facebook/react",
                    "question": "What is Suspense?",
                },
            )
            # connect() translates any failed tool result into a coded
            # DeepintShieldError before call_tool() returns.
            for part in result.content:
                if isinstance(part, TextContent):
                    print(part.text)
    except DeepintShieldError as exc:
        if exc.code == "mcp_tool_approval_required":
            print("The MCP action is waiting for approval.")
        elif exc.code == "mcp_tool_authorization_denied":
            print("The MCP action was denied by policy.")
        elif exc.code == "mcp_tool_authorization_unavailable":
            print("MCP authorization is temporarily unavailable.")
        else:
            print(f"DeepIntShield error [{exc.code}]: {exc.description}")


asyncio.run(main())

7.9 Govern an AI agent (LangGraph example)

Give the agent a name and create the client before you build your graph. The SDK then registers the agent, sends each tool call to the policy engine and stops on a deny. Your LangGraph code stays ordinary LangGraph code.

import operator, os
from typing import Annotated, TypedDict
from langgraph.graph import END, START, StateGraph
from deepintshield import DeepintShield

shield = DeepintShield(
    virtual_key=os.environ["DEEPINTSHIELD_VIRTUAL_KEY"],
    agent_name="refund-agent",           # or set DEEPINTSHIELD_AGENT_NAME
)

class State(TypedDict):
    account_id: str
    events: Annotated[list[str], operator.add]

def read_account(state: State) -> dict:
    return {"events": [f"read {state['account_id']}"]}

def notify_owner(state: State) -> dict:
    return {"events": [f"notified owner of {state['account_id']}"]}

builder = StateGraph(State)
builder.add_node("read_step", read_account)
builder.add_node("notify_step", notify_owner)
builder.add_edge(START, "read_step")
builder.add_edge("read_step", "notify_step")
builder.add_edge("notify_step", END)
app = builder.compile()

print(app.invoke({"account_id": "acct-42", "events": []}))

A new agent stops with agent_registration_pending on its first run and prints Registration pending. Reference <registration id> · runtime key SHA256:<thumbprint>. Contact your administrator. You will be notified at <your e-mail>. Set DEEPINTSHIELD_REGISTERED_BY to your work e-mail before the first run. It is the explicit way to name the registering developer. The gateway maps it to a person in the workspace directory and e-mails you there; it is not verified and grants nothing. A different e-mail for an agent already being registered is refused. The closing sentence appears only when the gateway confirmed the address. Do not put your own e-mail in DEEPINTSHIELD_REQUESTER instead: the requester is the person the agent acts for and changes authorization, and an e-mail-shaped requester is only an advisory hint that the gateway uses only for a person the organization placed in the workspace. You cannot approve your own agent. An administrator completes owner, identity, runtime key, code and tools in one review sitting (section 11.4); you receive an e-mail from the platform no-reply mailbox when the decision is made, and the next run of the unchanged script executes the whole agent. Other frameworks work the same way: LlamaIndex, AutoGen, PydanticAI, OpenAI Agents SDK, AWS Strands, Google ADK and Temporal. LiteLLM completion calls use the provider gateway path; Agentic checks apply to actual tool execution.

Keep the framework's native agent, tools and runner. DeepintShield adds source reporting and authorization at the supported execution boundary. Native Google GenAI clients from shield.genai() also govern automatic Python callable tools while keeping native chat, sync/async and streaming APIs. Ordinary model calls and declarative tool schemas remain on the inference path; remote MCP tools use the governed gateway connection.

When your code names an authorization target for a governed tool (permission= and object= on shield.agentic.tool(...) or a framework tool), use the forms the gateway authorizes: the object is <type>:<id> (resource:invoice-42, request:req-1) where the type is one of the authorization model's object types and the id holds no :, #, * or whitespace, and the permission is either a relation of that type (can_view, can_edit, can_fulfill) or a custom permission key containing : (invoice:approve) that the agent or its delegating user must hold. Since Server 3.2.2 (23 October 2026) a target in any other shape is refused before authorization with 400 invalid_object or 400 invalid_permission, and the message names the value and the accepted forms, instead of the earlier authz_engine_error denial.

7.10 One-line framework binders

chat_model   = shield.bind("langgraph").model("gpt-4o-mini")
embedder     = shield.bind("langgraph").embedder("text-embedding-3-small")
llama_llm    = shield.bind("llamaindex").llm("gpt-4o-mini")
pydantic_llm = shield.bind("pydanticai").model("gpt-4o-mini")

7.11 Handling errors

Provider and inference errors can use DeepintShieldError. Agentic enforcement also raises marked PermissionError, ConnectionError or RuntimeError exceptions. Use deepintshield.errors.get_exception_error_code(exc) to read their stable code instead of matching the message text. Common outcomes:

Guardrails are the safety rules that check every prompt going in and every answer coming out. A policy is a named set of checks with an enforcement mode. You attach policies to Virtual API Keys, so different apps can have different rules.

8.1 The Policies page

Open AI Guardrails → Policies. The top card shows your organization's policy allowance. Below, the Policies card has four tabs: Policy Catalog (your saved policies), Policy Editor (create or edit), MCP Security and RAG Security.

8.2 Create a policy

1. Click New Policy (blue button, top right).
2. Type a Policy Name. Leave Domain Pack empty for now (domain packs are a Business feature, see 8.3).
3. Under Applicable Scopes keep Input, which is selected by default, and add Output. Add Action, MCP or RAG if the key also serves agents, tools or document retrieval.
4. Choose the Enforcement Mode: Block stops the request; Redact removes the sensitive part and lets the rest through. Start with Block for input and Redact for output if you handle personal data.
5. Keep Execution Mode = Sync (the check finishes before the request continues). Async checks in the background without delaying the request, and Shadow only records what would have happened, which is the safest way to try a new policy. Keep Sampling Rate = 100 and Timeout = 150 ms.
6. Configure a working detector through AI Guardrails → AI Models. Connecting a model provider creates its linked guardrail policy; remove an obsolete legacy detector selection before enabling an older policy.
7. Under All Checks click Add on every check you want, for example LLM01 Prompt Injection and LLM02 Sensitive Information Disclosure. They move to Selected Checks. Use the filter chips: OWASP 2025, OWASP Agentic 2026, Domain, Custom.
8. Scroll to the bottom and click Create Policy. Then click Publish so the policy becomes live. Every later change creates a new version; use Rollback to return to an older one.
9. Open Access & Credentials → Virtual API Keys, edit your key and add the policy under Guardrail Policies.

8.3 Domain packs and OWASP Agentic checks

On the Business plan the Domain Pack drop-down offers ready-made check sets for banking (BFSI), healthcare, insurance claims, enterprise copilot, customer support, development assistant and agentic runtime protection. The OWASP Agentic 2026 filter adds checks for agent-specific threats such as goal hijack, tool misuse and excessive agency. Pick a pack, review the checks it added, and publish.

8.4 Policy Catalog

The Policy Catalog tab lists every policy with its scope, stages, mode, pack and version. Click a row to open that policy in the Policy Editor. The Selected policy panel under the table shows a summary of the current policy, with an Open Editor button.

8.5 AI Models (detectors and fine-tuning)

AI Guardrails → AI Models configures supported detector providers and their linked guardrail policies. Connect and verify an available detector before relying on its checks. The gateway can use an enabled sidecar or the selected provider according to deployment configuration; a policy name alone does not establish detector readiness. Use Fine-tune (LoRA) only when the corresponding training and model-serving services are configured.

8.6 Safety Providers (Bedrock, Model Armor, Azure, webhook)

If you already use a cloud safety service you can plug it in as an extra check.

1. Open AI Guardrails → Safety Providers and click New Provider.
2. Choose the type: AWS Bedrock Guardrails, Google Model Armor, Azure AI Content Safety, DeepintShield Models or Custom Webhook (BYO).
3. Fill in the credentials the form asks for, then click Save. The panel closes, and a linked guardrail policy with the provider's name is created.
4. Click the provider's row (or Edit) to open it again, then click Test. A green message means the connection works. Add the linked policy to your Virtual API Key under Guardrail Policies.

8.7 Findings

AI Guardrails → Findings is the list of everything a policy caught: the stage, severity, outcome and the check that fired. Use the filters at the top to narrow it down. Three tabs separate Policy Findings, AI Model Findings (detector hits) and RAG Findings.

8.8 Guardrail Metrics

Analytics → Guardrail Metrics turns the findings into charts: how many requests were checked, blocked or redacted, how long checks took, and separate tabs for Runtime Signals, Agentic & Tools, RAG, Safety Providers, AI Models and Multimodal.

8.9 MCP Security

The MCP Security tab of the Policies page applies guardrails to tool calls made through MCP servers: each tool call and each tool result is classified before it reaches the agent. Your policies already run the shared checks here. To add MCP-specific limits, pick the policy, click Add Rule to restrict a server, tool, identity or destination domain, then click Save Rules. Recent MCP traces and findings are listed underneath.

8.10 RAG Security

The RAG Security tab screens the content your AI retrieves. Your application must enforce document permissions before submitting chunks. First register each document source with Register RAG Source (name, connector, index name, sensitivity, trust level, labels) and click Create Source. The Source Inventory then shows each source's trust level, health and chunk count, with Quarantine and Release buttons. Every retrieved chunk gets a trust score and an injection score, and the policy decides to allow, warn, redact, quarantine or block it. Use the SDK call from section 7.7 to send chunks for checking.

Open Cost Optimization in the left menu. Every tab holds one or more switches that you can turn on for all or some Virtual API Keys. A feature that is not in your plan shows a View plans button instead of a switch: provider prompt caching, request coalescing, the guardrail cache and parallel tools work on every plan, while semantic caching, cascade routing, compression, RAG optimization and summarization need Team. Click Save changes after you change anything. Only the fields you changed are sent; the gateway checks the values and keeps your other settings as they were, and if it cannot apply a change it puts the previous settings back.

9.1 Caches

1. Provider Prompt Caching: the SDK adds supported cache hints and the gateway applies your workspace policy. Repeated eligible prefixes can cost less; the selected model's cache read and write rates determine the savings.
2. Semantic Caching: turn it on to answer repeated or very similar questions from memory instead of calling the model. Choose the embedding provider and model, and keep the Similarity Threshold at the default 0.88 (higher means "only very close matches"). This switch controls semantic caching only; the other tabs keep their own settings.
3. Under Apply to virtual keys leave All virtual keys or pick specific ones.
4. Click Save changes.

9.2 Intelligent Routing

Four switches live here: Request Coalescing, Intelligent Cascade Routing, Batch Eligibility Analysis and Reasoning Effort Throttling. Request Coalescing (recommended, keep it on) merges identical requests that arrive at the same moment into one provider call. Intelligent Cascade Routing sends easy requests to a cheaper model first and escalates only when needed: turn it on, click + Add tier at least twice (a cheap tier such as gpt-4o-mini and a premium fallback such as gpt-4o), pick the classifier virtual key, then Save changes. The cascade only reroutes traffic for keys inside its Apply to virtual keys scope. Batch Eligibility Analysis reports which requests could use a provider batch endpoint; it does not send batches.

9.3 Prompt Optimization

Compresses long prompts before they reach the model, using a small model that keeps the meaning. Good for chat history and long documents.

9.4 RAG Optimization

Re-ranks the retrieved documents and keeps only the most relevant ones, so fewer tokens go to the model. Max chunks is a hard limit on what is forwarded, even when the reranker is unavailable, and retrieval context placed in the system message is detected too.

9.5 Summarization and Parallel Tools

Summarization shortens long conversations automatically. Parallel Tools lets the gateway run independent tool calls at the same time to cut latency.

9.6 See how much you save

On Analytics → Overview, the Summary, Cache and Cost Opt tabs use the selected time window and filters. Cost shows the available cost total, and Estimated Gateway Savings shows the estimated savings from caching and optimization. Cost cards and graph totals stay numeric; a cost with no recorded amount displays as $0.00.

Savings Rate is estimated gateway savings divided by cost plus estimated gateway savings, multiplied by 100. For example, $3 of cost and $1 of savings gives 25%. The rate displays 0.0% when that baseline is zero or negative. Savings can be negative when cache writes or optimization calls cost more than the estimated amount avoided.

Estimated Agentic-Cache Savings is shown separately from gateway savings. Use it to review the Agentic cache's own events; do not add the two as one request total. It is hidden when the selected request filters cannot be applied to that series.

The Agentic section of the left menu brings together MCP connections, access controls and execution evidence. Team includes MCP connections within its quota, external context-policy configuration, task authoring and recorded activity. Guided access and governed SDK execution require Business or a supported standalone deployment. Check the gateway's runtime readiness and the plan labels below before configuring a workload.

10.1 Register an MCP server

1. Open Agentic → MCP Registry and click New MCP Server. Use this dedicated page for connections and MCP settings.
2. Type a name, the server URL and pick the transport (usually HTTP (Streamable)). Add authentication if the server needs it.
3. Click Create. The gateway connects, lists the server's tools and shows them in the table.
4. Add the MCP client to a Virtual API Key (section 6) so your app can use it through the gateway.

10.2 Check and grant access (Guided access)

1. Open Agentic → Policy & Access → Guided access. Select Agent, Acting for (a user or Agent directly), Permission, Resource type, Resource name, Tool and the exact named Action where applicable.
2. Click Check access and read the individual checks. Identity, resource permission, tool/action access, any delegation and runtime context must all permit the request.
3. When the selected access is intended, use Grant access, then check the same request again. Review any partial-save message before retrying. A configured direct grant alone does not prove effective access for every request.

Use Temporary delegation below this form when an agent acts for a user. Select the agent, user, resource and Expires in, then Create delegation. Review or revoke active delegations here. Where Entra on-behalf-of exchange is configured, Mint an actor token exchanges the user's credential for the delegated workload token; the delegation itself is not a credential.

10.3 Runtime policy

Open Policy & Access → Runtime policy. Enforcing applies authorization denials; Advisory records the runtime policy result for a bounded rollout. Canonical MCP execution still requires an Allow decision. Changing this setting does not supply missing workload proof, source code or registration approval. The switch saves when changed.

For an external context policy, select OPA (Rego) or Cedar, enter its Decision URL, then Save & enable (or Save when already enabled). The external decision is combined with normal access checks; failures deny the call. Team can edit this context policy; enforcement mode and Blueprint protection are Business controls.

Blueprint protection includes the static scan, optional Model review, and Block runtime drift. Section 11.6 explains their separate effects. Task scope and authorization ancestry adds explicit task bounds and evidence, covered in section 11.11.

10.4 Activity

Agentic → Activity shows recorded Runs (workflow executions), Decisions (allow, deny, approval required, with the reason) and Trends over time. Start here when an agent stops: inspect the reason code and linked evidence. The Audit tab shows the latest 200 relationship changes, including who granted or removed access and when. Its filters apply within that recent window; use Advanced → Policy model → Changes for model history.

10.5 Agentic and MCP analytics

Use Agentic → Activity → Trends for agent authorization trends; Analytics → Agentic shows the same charts. Analytics → MCP charts MCP tool calls, and Analytics → MCP Activity is the raw log of each MCP call. The Activity tabs are the current navigation for agent evidence; the MCP Registry remains a separate sidebar destination.

Use the five Agentic pages below to discover a workload, establish its identity, review its code and access, then operate it. Select the correct workspace before starting; provider records, reporting keys, registrations and access choices must belong to that workspace. The current sidebar contains Agents, MCP Registry, Identities, Policy & Access and Activity.

11.1 Agents → Needs attention: your daily inbox

Agentic → Agents → Needs attention collects new agent registrations, incomplete access plans, action approvals, changed code, tool drift and blocked or failed runs. Filter the queue, open a row's review or linked evidence, and resolve the relevant issue. Registration reviews preserve completed checks while you finish the remaining ones.

For a new agent, follow section 11.4 through the six sections: Identity & owner, Code & changes, Tools & access, Runtime access, Validate changes and Review & decide. An approval of one risky action, a code review, or a provisioning job does not complete the other checks. The Security evidence button opens configuration evidence, recent decisions and validation gaps by OWASP Agentic risk; it is not a certification that every risk is prevented.

11.2 Agents: inventory, shared assets and discovery

1. Open Agentic → Agents. The Agent inventory tab lists every agent that has been seen or registered, with its status.
2. Run the saved workload with its reporting key to send discovery; a new registration waits in Agents → Needs attention. You can also use Add agent for a local inventory entry. That entry does not create an Entra or OIDC identity and grants no access. Use Identities → Provisioning when an external workload identity must be created or linked (section 11.4).
3. Open an agent to review Identity & owner, Granted access and Activity & evidence. Direct grants show the configured relationships; use Guided access to evaluate inherited permissions and the actual request. Review discovered details before making an entry operator-managed; later discovery does not overwrite operator-owned fields.
4. In Shared assets → Tools & actions, review each tool's risk, action class and named actions using Review & classify. Open a tool and use Named actions and Granted access to inspect the exact tool/action boundaries and their configured callers. Tools that belong to one agent are on that agent's Tools & actions tab. A tool requiring named actions cannot execute with an empty action list.
5. Open Shared assets → Workflow maps for the observed agents, tools and connections of each shared workflow; an agent's own map is on its Workflow map tab. Open Discovery for inventory events and drift history. Discovery records what was observed and grants no access.
6. Use Agentic → MCP Registry for MCP server transports, authentication and connection settings (section 10.1). Older MCP bookmarks redirect to this dedicated page.
7. Click Export AIBOM to download the governed tool and action inventory in CycloneDX format. Inspect the attestation before treating it as signed: exports are unsigned when the deployment has no signing seed.

11.3 Tool grants and changed definitions

Grant exact tool actions in the registration review or Policy & Access → Guided access. A missing grant is an access failure; a policy-required human action approval is a separate pending decision. Use the decision's reason and linked action to reach the correct review.

1. When Agents → Shared assets → Tools & actions reports Definition changed, open Review definition change. Inspect the Approved and Now advertising digests and first-seen time. Review the actual upstream description and argument schema separately; this dialog does not display a full contract diff.
2. Choose Keep denying while the change is unexplained, or disconnect the MCP server. Calls remain denied while its definition is unapproved.
3. Use Approve new definition only after reviewing the change. This re-pins existing grants, tuples and approvals to the new definition; it is an access decision, not an inventory refresh.
4. Rerun the workload and inspect Activity → Runs and Decisions for its execution outcome and current authorization result.

11.4 Identities: verify, provision and approve

Agentic → Identities holds the users, groups, roles, permissions and service accounts your policies refer to. Use Add user or Import from Entra for accountable human owners. A human can own many agents; each independently governed agent reuses its workload identity across runs and has a separate run ID for every execution.

1. In Users, create or import the accountable human and confirm the identity is active. A service account cannot be the accountable owner. Directory entries describe policy principals; adding one does not provision an external workload identity.
2. Use Groups to manage memberships and Roles to manage shared assignments. Define the needed resource permissions in Permissions. Review the selected permissions and members before saving; governance labels and namespaces do not themselves grant resource access.
3. Confirm an active reporting key under Access & Credentials → Virtual API Keys. The workload uses that key's secret separately from its provider-issued credential. Selecting a reporting key in the review proves neither identity nor code.

Configure verification once. An authorized operator opens Identity providers and selects Microsoft Entra Agent ID or generic OIDC. Reuse the existing provider if it already describes this issuer and intended agents.

1. For Entra, fill Directory tenant, Audience (verify) and Blueprint application using the customer's Entra tenant, gateway token audience and existing parent blueprint client ID. Check the generated authority and JWKS URI. The child identity is distinct from the parent blueprint and the workload host.
2. Have the identity administrator authorize management access, approved sponsor user/group IDs and the blueprint runtime credential. Gateway-managed authentication keeps that runtime credential in the gateway; direct-token mode instead needs the workload host's federation. Provisioning does not create or authorize a new tenant or blueprint.
3. For a new shared Entra verifier, choose Agent admission → Shared agents · explicit identity list. Leave the list empty before the first child exists: it admits nobody. Enable the provider, click Save, then Test. The embedded registration editor offers Save & validate for the same checks.
4. Keep an existing single-agent setup as One existing agent when appropriate. Explicitly switching it to shared admission carries only its currently admitted child. Ordinary edits preserve existing list, prefix and any policies; they do not silently widen trust.

For Keycloak, Auth0 or Okta provisioning, select a generic OIDC verifier with the correct issuer, audience and signing keys. Leave provider-wide client-ID defaults empty and use the token's sub as the principal. Each workload receives its own client ID. See the provider-specific setup: https://aidocs.deepintshield.com/enterprise/agent-workload-identity/#provision-identities-from-deepintshield

Choose management credential storage. For Entra, Management credentials → Paste credentials accepts the management application's client ID and secret in the UI. The gateway encrypts them and never returns the saved secret to the form. No credential environment variable or manual encryption_key is required: the gateway uses its configured key or creates provisioning-credentials.key in its persistent data directory. Preserve the database and key together; gateway replicas must share the key. Server-configured credential references remain available for deployments that use them. Management credentials are separate from blueprint runtime credentials and never belong in the agent script.

For Link existing, an authorized operator must allow the precise provider object ID for this workspace: use Allowed existing child identity IDs with stored Entra credentials, or linkable_external_ids in the configured server reference. Configure Vault KV v2 delivery only when the selected provider issues workload secrets that require delivery. Full provider-specific requirements: https://aidocs.deepintshield.com/enterprise/agent-workload-identity/#provision-identities-from-deepintshield

Authorize provisioning in the UI. Customers who provision identities externally can keep that process and proceed to declaration, workload proof and review below.

1. Open Identities → Provisioning → Authorize provisioning. Enter a Connection name, choose Management provider (Microsoft Entra, Keycloak, Auth0 or Okta), and select the existing Workload verification provider.
2. Verify the inherited Token issuer, Gateway audience, and for Entra, Directory tenant and Authorized blueprint. Set Management URL to the administrator-approved endpoint; for Entra use https://graph.microsoft.com. Enter Realm for Keycloak. Set Allowed scopes to exactly the authorized workload scopes, separated by spaces.
3. For Entra, select Paste credentials, enter Management application (client) ID, Client secret VALUE and approved Sponsor user object IDs. Select Assign Gateway.Invoke when creating agents only after the management application has the documented Graph permissions and admin consent. For a configured reference, enter its reference in the reference field. Leave credential delivery empty for Entra. Keep Connection enabled on, then Save connection.
4. In Provisioning → Connections, click Check connection. Open Activity, wait for Completed, and inspect errors before continuing. A successful check confirms management connectivity; the identity create/link job must also complete.

Create or link the workload identity. Use the existing child identity when one has already been created for this workload.

1. Click Create or link identity, select the checked Connection, then choose Link existing or Create new.
2. Enter the stable Agent key (for example simple-math-agent-3), Display name, active human Accountable owner and Environment (for example development). Keep this exact agent key in DEEPINTSHIELD_AGENT_NAME on every run.
3. For Link existing, fill Existing provider object ID with the exact management API object ID and Expected token identity with the issuer's actual principal. For Entra, this connector uses the confirmed child agentIdentity.id as the child client ID. Generic OIDC normally uses sub, which can differ from the OAuth client ID. Click Link identity.
4. For Create new, use Create identity and retain the returned identity. Entra creates a child of the authorized blueprint without issuing a child secret. If enabled, the provisioning job also assigns the gateway's exact Gateway.Invoke application role. Other supported providers use configured Vault delivery or supported public JWKS enrollment; the private key remains with the workload.
5. Wait for the job in Activity to become Completed, then inspect Created & linked. A completed create/link records the expected identity declaration and provider admission automatically; do not declare it again. Run and verify is the next state. Older declarations have a separate count and do not imply a completed provisioning job.

Register in two runs. The developer runs the saved script with four settings; an administrator finishes the review in one sitting; the next run executes. Provisioning, an active reporting key and a successful provider test are setup evidence; a real run must prove runtime identity and capture source. For the complete Microsoft and local-gateway math-agent setup using gateway-managed authentication, follow section 15 or https://aidocs.deepintshield.com/enterprise/entra-local-gateway/

1. Set four values in the script's environment: DEEPINTSHIELD_BASE_URL, DEEPINTSHIELD_VIRTUAL_KEY, DEEPINTSHIELD_AGENT_NAME and DEEPINTSHIELD_REGISTERED_BY (your work e-mail; it is mapped to a person in the workspace directory and notified, and it is not verified). Install deepintshield[runtime,langgraph] 3.2.0 or newer; from this repository use python3 -m pip install -U './deepintshield[runtime,langgraph]'. Direct Entra-token mode uses the azure extra instead and needs an Azure-hosted workload. Use DeepintShield.from_env() and resolve any script assignments that override these settings.
2. Run 1 (developer). Run the saved script once. The SDK captures the source, enrols its runtime key and prints Registration pending. Reference <registration id> · runtime key SHA256:<thumbprint>. Contact your administrator. You will be notified at <your e-mail>. Keep the reference and thumbprint; there is no review link and you cannot approve your own agent. The closing sentence appears only when the gateway confirmed your address. The administrators receive a review-needed e-mail.
3. Review sitting (administrator, not the owner). Open Agents → Needs attention and click Review on the registration row, or Review next agent. The header shows Registered by and the address, given by the developer and not verified. The Accountable owner is proposed from it: click Confirm owner or choose another person. Confirm display name and framework; editing the display name does not change the workspace key.
4. Identity & owner. Select the enabled, validated Identity provider and create or link the Entra child / OIDC client from this sitting, or confirm the completed provisioning job. Only when the workspace allows it, and only for development, choose Approve as VK-trusted (development only) instead. A prefilled identity is not proof, and changing a proven binding is not a rename.
5. Runtime access. Compare Key fingerprint with the developer's thumbprint, then click Authorize runtime key (Approved runtime key · any host for a laptop, or a cloud identity rule). A key that arrived before the identity existed is marked Provisional and can be authorized once the identity is linked. Direct-token mode uses Run setup and the workload host's Entra credential instead.
6. Code & changes and Tools & access. Review the source artifacts and scan findings (section 11.6 if capture is incomplete). Select only the discovered named actions the workload requires; for the two-node LangGraph arithmetic example, add_two / invoke and multiply_by_three / invoke, which need no additional resource permissions. Use Roles & resources and Additional access only when resource access is required; check a reusable choice's exact actions and permissions before approval.
7. Validate changes → Review & decide. Click Validate & continue if it is shown, then select Approve now, activates on the agent's next run and confirm with Approve now · activates on next run; the card shows Decision recorded and lists the actions that activation will grant. A second person must do this: the owner cannot approve their own agent. Resource permissions are not part of a recorded decision and are added after activation. To reject the registration, enter the required note and Deny. The registrant is e-mailed either way.
8. Run 2 (developer). Run the unchanged script again. The gateway applies the recorded decision before answering and the whole agent executes: the decision grants every action the administrator selected, so the arithmetic example prints {'number': 21}. A script changed after the decision was recorded re-opens review: the recorded decision becomes Stale decision and a new review is needed.

For the complete arithmetic source to save as test2.py, see https://aidocs.deepintshield.com/sdk/agents-agentic/#first-run-simple-math-agent . The refund-agent example in section 7.9 has different functions; review the exact actions discovered from the script you actually run.

For generic OIDC workloads, OIDC_SCOPES can supply per-client scopes separated by spaces. If unset, the SDK uses the verifier's defaults; an explicitly empty value requests no scopes. Use a current SDK build containing this override and keep provisioning credentials out of the workload. A mounted ready-record launcher is described in https://aidocs.deepintshield.com/sdk/agents-agentic/#provisioned-workload-credentials

Repair or retire from the same tab. If an unused connection's verifier settings were corrected, use Use current verification settings and save; a connection already used for identity jobs cannot be repointed. A conflict names the agent holding the identity. Use Release declaration only when the server confirms there is no current or historical proof. For a denied registration that should be reviewed again, use Re-enrol agent and complete fresh proof and approval. Denial alone never frees an identity. Supported managed identities expose lifecycle actions such as rotation, disable and retirement; inspect each job's result. Disable and Retire quarantine local access before remote changes; linked customer identities remain read-only. Retry uncertain jobs through their saved job rather than submitting a duplicate create.

11.4.1 Server run: managed execution

With managed execution enabled on the gateway, SDK 3.2.3 transparently submits supported native LangGraph workloads before their first local invocation. An operator can enable server runs for every workspace at once. Limiting them to selected workspaces is optional. Only an identity that uses gateway exchange can finish a server run. Where server runs reach every workspace, any other identity runs on the developer's machine after its server run ends, and in this release that first local run asks for one more code review. In a workspace listed for server runs such an agent cannot run, and the SDK reports managed_gateway_runtime_required. Keep DEEPINTSHIELD_REQUESTER empty and omit delegated/task context for this server-run mode. Configure the deployment worker, durable storage and required Python packages first. In the registration review, Runtime access → Server run shows Identity → Runtime → Approval → Run and the next required action. The client can close after the submission is accepted; the server still requires identity proof, runtime authorization and code/access approval.

A server runtime key is separate from the key on a developer laptop. Review and authorize the server fingerprint before preparation can continue. Runtime compatibility pending means the worker image lacks a package the program imports; have the operator add it to the image, then resume the existing submission. The worker runs its own SDK, Python and package releases, so the laptop's SDK, Python and package versions never need to match it. The worker resumes the saved job after its prerequisites are met. With a gateway and SDK that support submission IDs, running the unchanged script again starts a new server run under the existing approved registration. An active or uncertain run must be resolved first. The script prints the completed run's saved output and exits without running the local graph or the code after it. Inspect completed or failed execution evidence in Activity → Runs.

See https://aidocs.deepintshield.com/enterprise/managed-agent-execution/ for worker deployment and https://aidocs.deepintshield.com/sdk/agents-agentic/ for the SDK submission API.

11.5 Enrolment policies

1. Open Agentic → Policy & Access → Enrolment → New policy. Name the policy and choose the trusted Identity provider.
2. Set Matches, Identity values and Priority (the lowest priority number wins). Keep the match limited to the intended provider-issued identities.
3. Choose the active human Accountable owner, Risk tier, Namespace and Max scan finding. Enable the policy and click Save policy.
4. Run an eligible workload with a verified token, then inspect its registration and decisions. Eligible matching workloads can enrol automatically; exceptions wait in Agents → Needs attention. Provisioning alone does not satisfy code or access readiness, and an enrolment rule is not a blanket tool grant.

11.6 Blueprint scans (code review of agents)

The SDK reports redacted executable source during discovery and the gateway scans the reported code. Open Code & changes in a registration or a Code review row in Agents → Needs attention to inspect the current digest, artifacts, findings and review status. Source is scanned and discarded; digest-based caching avoids repeating a scan on every execution.

Install the current checkout in the same Python environment that runs the workload when testing local SDK fixes. Source capture distinguishes SDK instrumentation from application functions even when the SDK or virtual environment sits below the script directory; application decorators and local helpers remain part of the scan. A package version number alone does not confirm which source build is loaded.

1. Open Policy & Access → Runtime policy → Blueprint protection. Static scan remains enabled. To add Model review, select an active Scanner virtual key from the same workspace and a model available through that key, then Save. Model review runs during discovery.
2. Set Block runtime drift when reported code changes must receive a fresh review even if the scan finds no new risk; click Save. This checks reported code and gateway-observed tool definitions before protected actions. It cannot monitor code outside those reporting paths.
3. For blueprint_coverage_incomplete, run the saved .py file with a current SDK in the same Python environment. Ensure every local executable function is readable and graph discovery runs inside the DeepintShield context. Rerun discovery and refresh the review.
4. Confirm artifacts are present and the scan has completed before approving the exact code. If coverage is still incomplete, investigate source capture and SDK diagnostics. Changing the provider, reporting key, model or display name cannot repair missing source.

11.7 Human approvals for risky actions

Write-like actions (for example "send e-mail" or "update record") can be set to require a person. Execution stops before the action, and the item appears under Policy & Access → Action approvals and in Agents → Needs attention for Approve or Deny. Local SDK enforcement raises RuntimeError with code require_approval; the MCP path reports mcp_tool_approval_required. The SDK does not automatically wait and retry every workflow. Approvals need Business on the Action approvals page and in the embedded tab under Policy & Access alike.

Review the Agent, On behalf of, Tool / action, Target and Approval authority before deciding. Use the Pending, Approved and Denied views to inspect outcomes. The pending call has not executed: after approval, resume the same call with the same arguments through the workload's supported resume flow. Changed arguments require a new decision; a denied call remains blocked. Confirm the execution result in Activity.

11.8 Advanced relationships

Open Policy & Access → Advanced → Relationships or Policy model to inspect who can do what to which object. Model provides Validate and Publish model; Tuples holds relationship facts; Assertions runs expected allow/deny checks; Explorer shows reachable objects or subjects; Changes records history. Validate the model and run relevant assertions before publishing policy changes. Use Guided access for the full request decision.

11.9 Agentic observability

Open Agentic → Activity → Runs for the recorded workflow topology, execution outcome and linked authorization evidence. Decisions explain why an action was allowed, denied or held for approval. Optional OpenTelemetry or Langfuse export is configured by the backend deployment and runs asynchronously; export failure does not change authorization. See section 13 for monitoring integrations.

1. In Runs, filter by agent and status, then open the affected execution. Distinguish running, awaiting approval, completed, blocked, failed and cancelled runs; an authorization allow is not proof that the tool completed successfully.
2. Follow the linked decision or open Decisions to inspect the allow, deny or approval-required result and the failed check. Resolve that check in the linked registration, policy, delegation, task or tool review.
3. Use Trends for aggregated decision history and Audit for recorded access changes. When a view reports missing or partial evidence, reload before treating an empty result as an absence of activity.

11.10 Agentic Cache

Open Agentic → Activity → Secure caches for cache reporting and security-cache views. Agentic Cache reports reuse and savings by workspace and Virtual Key; it does not itself enable tool-result reuse. Configure effective response and semantic reuse on the semantic cache and Virtual Key. Governed MCP execution bypasses the direct result cache. Tool-result, embedding and MCP-discovery switches on the Agentic caches tab record intent but do not enable reuse in this release. See https://aidocs.deepintshield.com/features/agentic-cache/ for the controls that take effect.

11.11 Task scope and authorization ancestry

Task authoring uses the Team policy permissions. Executing a workload under these controls also requires an available Agentic runtime and deployment signing support; follow the runtime-readiness state shown by the gateway.

1. Open Policy & Access → Runtime policy → Task scope and authorization ancestry. Click New task when task signing is available on the deployment.
2. Enter Purpose, Expires at · local time and Maximum authorizations. Add exact action scopes for the intended agents, tools, actions, permissions and resources. Each authorized action consumes one unit even if its tool execution later fails.
3. Where required, add label rules, parent authorization receipts, memory read/write constraints or an allowed sequence. Click Review task, inspect the complete bounds, acknowledge the review, then Issue task token.
4. Copy the token while it is shown and deliver it through the workload's credential handling. Configure the workload to attach the mandate and required parent/memory evidence. A task bounds existing access; it does not create identity, resource permissions or tool grants.
5. After workloads are sending valid mandates, enable Require a task mandate on every authorization and review its confirmation. Calls without a valid mandate will be denied. If signing is unavailable, the gateway administrator must configure it before issuance or enabling this requirement.
6. Open a task to review remaining budget, state, Authorization ancestry and memory evidence. Use the task's revoke action when future authorizations must stop, and confirm the recorded result. Revocation does not undo tool actions that already completed.

For the SDK mandate and receipt integration, see https://aidocs.deepintshield.com/enterprise/relationship-authorization/ and https://aidocs.deepintshield.com/sdk/agents-agentic/ .

12.1 Hallucination Control

Two parts: Control changes the request before it reaches the model (a grounding system prompt and a lower temperature) so the model invents less; Configuration scores the answers afterwards on faithfulness, relevance, coherence, helpfulness and citation precision.

1. Open Hallucination Control → Configuration. Switch on Hallucination evaluation and tick the detectors you want: Faithfulness, Answer relevance, Coherence, Helpfulness and Citation precision. Helpfulness uses a small judge model through one of your virtual keys, so pick the key and a cheap model (gpt-4o-mini works well). Streaming answers are scored once the stream completes. If you untick every detector, nothing is scored.
2. Under Performance set the Sample rate (10% is recommended so only a share of answers is scored), pick the virtual keys it applies to and click Save.
3. Open Hallucination Control → Control. Switch on the techniques you want: Stay grounded, Don't make things up, Require sources, Hedge when unsure and Reduce randomness (caps the temperature at 0.4 by default). Choose the Strictness, pick the keys and click Save.
4. Optional: open Ground Truth, click Download template CSV, fill it with questions and correct answers, then Upload filled CSV and Save ground truth. Scores are then measured against your own answers. The template has an optional vk_id column; leave it blank to use the Apply records to dropdown. An upload replaces only the keys named in that file, and Clear all references empties the corpus.
5. Watch the results on Analytics → Overview → Hallucination.

12.2 Consistency

Consistency makes sure the same question gets the same approved answer every time.

1. Open Consistency → Policy & Modes and pick a mode: Off, Exact-Match, Semantic, Semantic + Pinned or Strict. Start with Semantic. Strict also sends temperature 0, seed 42 and top-p 1 whenever it has to call the model.
2. Set the Semantic match threshold (default 0.93), the Scope (tenant, application, route or per-user) and how long answers stay fresh (default 72 hours). Save.
3. Open Consistency → Golden Registry to upload approved answers (CSV). These are served word for word when a matching question arrives. Each upload is a new version; if two people save at the same time the second save is refused, so reload and try again.
4. Use Consistency → Request Trace to see, for any request, whether the answer came from an exact match, the semantic cache, a pinned answer or the model. It also says why a request was not eligible: Consistency reuses answers for ordinary (non-streaming) chat requests only; streaming, Responses API and tool calls always go to the model.

13.1 Dashboards

Analytics → Overview has tabs for Summary, Cache, Cost Opt, Hallucination, Consistency, Teams, Providers, Models, MCP and Load Balancer. Use Filters and the time picker (top right) to focus on one key, team or model. Compare cost cards and charts with the same filters, and allow new requests a moment to finish logging before refreshing.

13.2 AI Logs

Analytics → AI Logs is the full list of requests. Turn on Live updates to watch traffic as it happens. Each row shows status, time, type, provider, virtual key, team, model, latency, cache result and guardrail decision. Use Columns to add the hidden Message, Engine, Guard added, Tokens and Cost columns. Click a row for the complete request and answer.

The Total Cost card shows the cost amount for this range. Open a request to inspect its cost and token details, including provider cache usage when recorded. MCP Activity also displays numeric costs. A $0.00 display fallback does not add a new provider price to the stored record.

13.3 Exports

Open Analytics → Exports to send logs to your own storage.

1. In the Export Builder, set Frequency to On demand or a schedule, then choose the time range, the format (JSON or CSV) and the destination (S3, GCS, BigQuery, Snowflake or local download).
2. Tick the log types you need (AI Requests, AI Errors, MCP & Agents Logs and so on) and any filters.
3. Click Create Export. The export appears under Recent Exports with a download link when it is ready.

13.4 Alert Channels

1. Open Analytics → Alert Channels and click Add Channel.
2. Type a name, choose the Type (Slack incoming webhook, e-mail, or a signed webhook) and paste the destination.
3. Pick the Minimum severity and tick the Events you want: guardrail blocked a request, budget exceeded, rate limit hit, plan allowance threshold, agentic action denied, human approval required, tool integrity divergence.
4. Click Create channel. Alerts are throttled so a busy loop cannot flood the channel.

13.5 Integrations: OpenTelemetry and Prometheus

Open Analytics → Integrations. On the Open Telemetry tab enter your collector endpoint (gRPC or HTTP), choose the GenAI extension if your back-end supports it and click Save OTEL Configuration. The Prometheus tab enables the /metrics endpoint (metric names start with deepintshield_) and a Pushgateway for short jobs. A sample Grafana dashboard is provided.

13.6 Logging Controls

Governance Hub → Logging Controls is set per workspace. Enable Logs turns logging on or off, Disable Content Logging keeps only usage numbers (latency, cost, tokens) and drops prompt and answer text, and Log Retention Days sets how long rows are kept, up to your plan maximum (30 days on Team, 90 on Business). You can also list request headers to capture into log metadata. Click Save Changes.

14.1 Profile and security

Open Account Settings → Profile. Here you can update your name and e-mail, Enable MFA (a 6-digit code at sign-in, strongly recommended), generate a personal access token for scripts, and Download my data.

14.2 Appearance

Account Settings → Appearance switches between light, dark and system theme.

14.3 Legal

Account Settings → Legal keeps the signed copies of the terms you accepted at purchase, with their version numbers.

14.4 Updates

The version badge at the bottom of the left menu shows Update when a new feature release is available for your organization. Click it to open the Updates page and switch the release on when you are ready.

14.5 Playground

Playground lets you write a prompt, pick a provider and model, and run it through the gateway with all your settings applied, which is the quickest way to test a new guardrail policy. Running prompts works on every plan, including Developer. Saving prompts, sessions and versions needs Team or Business; on Developer those buttons and the Cmd+S / Ctrl+S shortcut are disabled and say why. If a configuration requires a virtual key, you can enter one for the run; it is never stored with the prompt.

Choose a provider and model, then review the available operation and input controls. The source integration update includes text, embeddings, reranking, OCR, image generation/editing, speech, transcription, and video, according to provider/model capability metadata. Unknown models remain selectable with an explicit operation choice when their task is unknown. The model list has no 1,000-model cutoff. When you switch models, previous model settings are cleared while streaming preference is preserved; saved chat sessions retain their stored settings. Missing parameter information does not invent sampling or reasoning defaults.

The selected model's catalog profile determines whether the Playground sends Chat Completions or native Responses requests. Both support streaming and tool conversations where the model supports them. Continue the same session for tool results and follow-up messages so the provider's conversation and tool-call identifiers are preserved.

14.6 Getting help

• Documentation: https://aidocs.deepintshield.com (also linked from the left menu).
• E-mail: support@deepintshield.com. Team plan replies within 24 hours, Business within 12 hours.
• Sales and Enterprise questions: sales@deepintshield.com.

Use this complete local-development walkthrough when both test2.py and the gateway run on your laptop. The browser and SDK both use http://localhost:8080. The gateway stores separate Microsoft management and blueprint runtime credentials; the SDK proves possession of an approved runtime key. No LocalEntraCredential class, Microsoft login or Entra secret is needed in the Python script. The canonical walkthrough is https://aidocs.deepintshield.com/enterprise/entra-local-gateway/

The Microsoft figures below are real, unmodified reference screenshots from Microsoft Learn, not captures of your tenant. Their example app names, IDs, role values and selected tabs can differ from this setup. Use the values in the written steps and the specific correction in each caption. Select any screenshot to enlarge it.

15.1 Start the updated local gateway

1. For a fresh installation, start Docker (for example Docker Desktop). Stop the previous local gateway process. From your checkout, use the commands below to start persistent authorization services and build/run the current gateway. Replace /path/to/DeepintShieldFull with your checkout.
2. The repository's local authorization compose file starts PostgreSQL, its OpenFGA migration and OpenFGA. The host ports 55432 and 18081 must be available. Reuse an existing service rather than starting another on an occupied port. Wait for the health check to succeed before starting the gateway.
3. If OpenFGA is already working, skip the compose/health-check bootstrap and set OPENFGA_API_URL to its address reachable from the laptop-hosted gateway. A container-only hostname is not that address. Keep AGENTICNEW_GAF_REQUIRED=true so required authorization fails closed.
4. If your existing gateway uses another application-data directory, preserve that directory instead of creating a new one. Open http://localhost:8080, sign in, and use the intended tenant and workspace.
5. Keep the gateway running while you perform the remaining steps. Use a second terminal for Python. Initial Microsoft token acquisition requires outbound network access to Microsoft login and Graph endpoints.

cd /path/to/DeepintShieldFull/deepintshield_server
docker-compose -p deepintshield-local-authz -f tests/agentic-local/compose.yaml up -d postgres openfga
curl --fail --retry 10 --retry-connrefused --retry-delay 2 http://127.0.0.1:18081/healthz
OPENFGA_API_URL=http://127.0.0.1:18081 AGENTICNEW_GAF_REQUIRED=true make run LOCAL=1 HOST=localhost PORT=8080 APP_DIR="$HOME/.config/deepintshield"

The command uses the standalone docker-compose available on the tested laptop. With the Docker Compose plugin, use docker compose with the same arguments instead. The fixed project name deepintshield-local-authz keeps the authorization database's named volume stable across runs. Retain that volume; do not remove it with down --volumes. No Keycloak service is needed for this Entra walkthrough. OPENFGA_API_URL and AGENTICNEW_GAF_REQUIRED configure authorization infrastructure; they contain no Microsoft credentials. The gateway build installs its UI dependencies and builds the UI/backend.

Credential storage uses the gateway's configured encryption key or automatically creates provisioning-credentials.key in its persistent application-data directory. You do not need to locate config.json or manually configure encryption_key for this fresh setup. Preserve config.db and the key across restarts/backups. Replicas must use the same protected key. An unwritable or unavailable data directory must be fixed before storing credentials; encryption is not disabled.

15.2 Microsoft: select the tenant and human sponsor

1. Open https://entra.microsoft.com and switch to the intended organization's directory.
2. Open Entra ID → Overview and record the Tenant ID as TENANT_ID.
3. Open Entra ID → Users → All users. Select the accountable person, for example Alex Morgan, and copy that person's Object ID as SPONSOR_USER_OBJECT_ID.
4. Use an administrator authorized to create app registrations and Agent ID blueprints and to grant the required Microsoft Graph application permissions. Agent ID Administrator covers blueprint management; granting Microsoft Graph application permissions requires an appropriately privileged administrator. If the Agent blueprints feature is unavailable, have the tenant administrator resolve its access/prerequisites before continuing.

Microsoft blueprint prerequisites: https://learn.microsoft.com/en-us/entra/agent-id/create-blueprint

15.3 Microsoft: register the gateway API

1. Open Entra ID → App registrations → New registration. Name the application deepintshield-gateway-local, choose Single tenant, leave Redirect URI empty and click Register.
2. Record its Application (client) ID as GATEWAY_CLIENT_ID. Add the responsible administrator under Owners if needed.
3. Open Expose an API. Next to Application ID URI, click Add, then save api://GATEWAY_CLIENT_ID, replacing the placeholder with the actual GUID. This autonomous flow does not need a delegated scope.
4. Open Manifest. Inside the existing api object, set requestedAccessTokenVersion to 2, preserve the other properties, then Save.

Microsoft app registration: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app . API identifier: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis . Token version: https://learn.microsoft.com/en-us/graph/api/resources/apiapplication?view=graph-rest-1.0

15.4 Microsoft: define the Gateway.Invoke application role

1. Inside deepintshield-gateway-local, open App roles → Create app role.
2. Set Display name to Gateway Invoke; Allowed member types to Applications; Value to exactly Gateway.Invoke; and Description to Allow an approved agent to invoke DeepintShield.
3. Check Enable this app role, then click Apply. The provisioning job will assign this role to the child agent; defining the role alone grants nothing.

Microsoft application roles: https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps

15.5 Microsoft: create an Agent ID blueprint

1. Open Entra ID → Agents → Agent blueprints → New agent blueprint (Preview). This creates an Agent ID blueprint, not an ordinary app registration named blueprint.
2. Name it deepintshield-local-blueprint and click Next.
3. Under Owners & Sponsors, select the responsible owner and sponsor. Click Next → Create → Go to agent blueprint.
4. Record its Blueprint Application ID as BLUEPRINT_CLIENT_ID. The portal wizard creates the blueprint and its blueprint principal.

Microsoft blueprint creation: https://learn.microsoft.com/en-us/entra/agent-id/create-blueprint

15.6 Microsoft: add the local-development blueprint credential

1. Inside deepintshield-local-blueprint, open Developer settings → Credentials → Client secrets → New client secret.
2. Enter description deepintshield-local-runtime, choose an expiration permitted by your organization and click Add.
3. Copy the secret Value immediately. Keep it available securely for section 15.12. Do not copy its Secret ID or put this secret in test2.py.

Blueprint credentials: https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-blueprint . Production credential guidance: https://learn.microsoft.com/en-us/entra/agent-id/autonomous-agent-authentication-authorization-flow

15.7 Microsoft: create the provisioning management application

1. Open Entra ID → App registrations → New registration. Name it deepintshield-local-provisioning, choose Single tenant, leave the redirect URI empty and click Register.
2. Record its Application (client) ID as MANAGEMENT_CLIENT_ID and add the responsible administrator under Owners.
3. Open Certificates & secrets → Client secrets → New client secret. Set description deepintshield-local-provisioning, choose an allowed expiration and click Add.
4. Copy the secret Value immediately. This management secret belongs in Provisioning → Management credentials, separate from the blueprint runtime secret in Identity providers.

Microsoft application credentials: https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal

15.8 Microsoft: grant management permissions and admin consent

1. In deepintshield-local-provisioning, open API permissions → Add a permission → Microsoft Graph → Application permissions.
2. Add the four permissions below. Click Add permissions.
3. Have an authorized administrator click Grant admin consent for your tenant. Confirm each permission shows Granted before configuring provisioning.

These are privileged Microsoft management permissions, especially app-role assignment. The gateway's opt-in constrains its own assignment operation to the configured gateway's Gateway.Invoke; it does not reduce the Graph application's tenant-wide permission grant. Keep the management credential on the gateway and use only the permissions needed for the enabled operations. A separately configured Microsoft manager-scoped creation model may use AgentIdentity.CreateAsManager; it is not a drop-in replacement without its manager relationship.

Microsoft permission references: https://learn.microsoft.com/en-us/graph/api/agentidentity-list?view=graph-rest-1.0 , https://learn.microsoft.com/en-us/graph/api/agentidentity-post?view=graph-rest-1.0 and https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0

15.9 DeepintShield: select the workspace and enable Agentic Security

1. Return to http://localhost:8080, sign in and select the intended tenant and workspace. Create a workspace through section 3 if this installation is fresh.
2. Open Agentic → Agents → Needs attention and turn Agentic Security On. Its local route is http://localhost:8080/workspace/agentic-new/overview.
3. Use a deployment/plan with the Agentic runtime available. If the page reports unavailable runtime or permissions, resolve that prerequisite before enrolling the workload.

15.10 DeepintShield: confirm the owner and reporting key

1. Open Agentic → Identities → Users. Reuse the active human owner, for example Alex Morgan. If missing, click Add user, enter display name/email, set Kind → User (human) and Status → Active, then Create user.
2. Open Access & Credentials → Virtual API Keys. Reuse an active key belonging to this local workspace and supply its secret to the SDK. A hosted gateway's key is not automatically valid in a separate local database.
3. If no key exists, first add a Model Hub provider configuration as described in section 5, then use Add Virtual Key, choose this workspace, name the key, select that provider configuration and click Create. The current key-creation UI requires a provider configuration; the arithmetic graph itself makes no model call.

The DeepintShield human owner is an accountable directory entry; Microsoft sign-in/SSO and delegated-user authorization are separate configurations. This walkthrough runs the arithmetic agent autonomously with an empty requester.

15.11 DeepintShield: configure the Entra verifier

1. Open Agentic → Identities → Identity providers, add an Entra provider and enter the values below.
2. Check that Authority is https://login.microsoftonline.com/TENANT_ID/v2.0 and JWKS URI is https://login.microsoftonline.com/TENANT_ID/discovery/v2.0/keys, using the actual tenant GUID.
3. Leave the new shared admission list empty. It admits nobody until provisioning adds the exact child. Continue with runtime authentication before saving.

15.12 DeepintShield: configure gateway runtime authentication

1. In this provider, keep Runtime authentication → Gateway exchanges Entra token · recommended, the default for a new Entra provider, and turn Gateway exchange enabled on.
2. Set Blueprint runtime credential → Client secret · development. Paste the blueprint secret from section 15.6 into Blueprint client secret VALUE.
3. Select This gateway runtime connection is for development. Leave Optional token scope settings unchanged for api://GATEWAY_CLIENT_ID. If you intentionally chose another API identifier, enter it under Gateway API application ID URI, without /.default.
4. Click Save → Test and confirm Validated. Provider validation checks verification configuration; the first real runtime exchange checks the blueprint credential and child token.

15.13 DeepintShield: authorize provisioning once

1. Open Identities → Provisioning → Authorize provisioning and complete the following fields. Check that the inherited tenant, blueprint, issuer and audience match your Microsoft setup.
2. Click Save connection, then in Connections click Check connection. Under Activity, wait for Completed and resolve any error before continuing.

No management credential environment reference is needed with Paste credentials. A successful Check connection confirms management connectivity; it does not create a child or prove the runtime exchange. Role assignment is applied when creating a managed child (or checking an existing managed child with the option enabled); linked customer identities remain read-only.

15.14 DeepintShield: create math-agent's child identity

1. In Provisioning, click Create or link identity → Create new. Select connection local-entra-provisioning.
2. Enter Agent key → math-agent, Display name → math-agent, the active human Accountable owner → Alex Morgan (or your owner), and Environment → development. Do not add agent: to the Agent key field.
3. Click Create identity and wait under Activity for Completed. Record the returned child identity ID.
4. The job creates the child, assigns Gateway.Invoke when enabled, adds the exact provider admission and declares agent:math-agent against that identity. Do not create another child or click Declare again after success. If a matching identity already exists, reuse its record; inspect/retry a failed saved job rather than submitting duplicate creates.

15.15 Laptop: install the updated SDK and prepare test2.py

In the Python environment used to run the script, install the current source checkout. The published SDK may not yet include these changes. Replace the checkout path in this command. If you use a virtual environment, activate it first.

cd /path/to/DeepintShieldFull
python3 -m pip install -U './deepintshield[runtime,langgraph]' 

For an existing test2.py, retain the graph and DeepintShield.from_env() and set the same URL, workspace key and agent name used above. For a fresh math-agent, the complete example below sets math-agent, http://localhost:8080 and an empty requester. It reads an existing DEEPINTSHIELD_VIRTUAL_KEY or prompts for the local workspace key without echoing it. Existing in-script assignments override exported values: change the assignment itself if the file currently names another agent, URL or requester. Reuse an existing agent name consistently instead if you intend to keep that agent's established identity.

import os
from getpass import getpass
from typing import TypedDict

from deepintshield import DeepintShield
from langgraph.graph import END, START, StateGraph

os.environ["DEEPINTSHIELD_AGENT_NAME"] = "math-agent"
os.environ["DEEPINTSHIELD_BASE_URL"] = "http://localhost:8080"
os.environ["DEEPINTSHIELD_REQUESTER"] = ""
if not os.environ.get("DEEPINTSHIELD_VIRTUAL_KEY"):
    os.environ["DEEPINTSHIELD_VIRTUAL_KEY"] = getpass("Local workspace virtual key: ")

class State(TypedDict):
    number: int

def add_two(state: State):
    return {"number": state["number"] + 2}

def multiply_by_three(state: State):
    return {"number": state["number"] * 3}

with DeepintShield.from_env() as shield:
    builder = StateGraph(State)
    builder.add_node("add_two", add_two)
    builder.add_node("multiply_by_three", multiply_by_three)
    builder.add_edge(START, "add_two")
    builder.add_edge("add_two", "multiply_by_three")
    builder.add_edge("multiply_by_three", END)
    graph = builder.compile()
    print(graph.invoke({"number": 5}))

No Microsoft secret, Azure SDK login or per-agent token-exchange code belongs in this broker-mode example. Clearing the requester selects autonomous execution; an application that acts for a user must configure that user's identity/delegation instead of claiming that an empty requester proves a user.

15.16 Run once: the SDK enrols its key and reports pending

export DEEPINTSHIELD_REGISTERED_BY='<your work e-mail>'
python3 test2.py

1. Expect one line: Registration pending. Reference <registration id> · runtime key SHA256:<thumbprint>. Contact your administrator. You will be notified at <your e-mail>. Keep the reference and thumbprint. You are not shown a review link and cannot approve your own agent; the administrators receive a review-needed e-mail and you receive a pending receipt, both sent from the platform no-reply mailbox. The closing sentence appears only when the gateway confirmed your address.
2. If the run is refused with registration_requester_mismatch, this agent is already being registered under a different e-mail. Export the e-mail it was first registered with, or ask an administrator to deny the pending registration.

15.17 One review sitting: identity, runtime key, code and access

An administrator who is not the agent's owner completes everything in one visit; do not run test2.py again before the sitting ends. An administrator who exported their own sign-in e-mail as DEEPINTSHIELD_REGISTERED_BY cannot record the decision, and cannot approve it at all while Require a separate reviewer for immediate approvals is on. In a one-person setup, export a different registering e-mail before the first run, or approve immediately after the agent's next run (three runs).

1. Open Agentic → Agents → Needs attention and click Review on the math-agent row. The Accountable owner is proposed from the registering e-mail: click Confirm owner or choose another person. Under Identity & owner, confirm Identity provider → local-entra and the child created in 15.14, or create or link it here. A runtime key that arrived before the identity existed shows Provisional and Runtime key received. Create or link the agent identity in Step 1, then authorize this key.
2. Open Runtime access. Check that Key fingerprint matches the SHA256 thumbprint from 15.16. Expand Details and check that Agent is math-agent, Entra child matches the provisioned child and Provider is local-entra. Your reporting key is shown under Identity & owner → Submission identity.
3. Click Authorize runtime key, choose Runtime identity policy → Approved runtime key · any host, then Confirm runtime authorization. This approves the pinned runtime key; it does not approve code or tool access. Check proof is no longer a separate run: proof arrives with the next run.
4. Open Code & changes and wait for complete source capture and a successful scan. Review any findings, then open Tools & access and inspect the discovered arithmetic tools.
5. Select add_two / invoke and multiply_by_three / invoke. For the unchanged pure arithmetic functions above, confirm read / low classifications. These functions require no additional resource permissions.
6. Open Validate changes (click Validate & continue if shown), then Review & decide: select Approve now, activates on the agent's next run and confirm with Approve now · activates on next run. The card shows Decision recorded and lists the actions that activation will grant, here both arithmetic actions; the registrant is e-mailed. The owner, and an administrator who registered the agent with their own sign-in e-mail, cannot do this step; the review shows You registered this agent or are its accountable owner. A recorded approval needs a different administrator. You can still approve after the agent's next run.

15.18 Run again: the approved agent executes

python3 test2.py

The gateway verifies the runtime key and the Entra exchange, applies the recorded decision before answering, and the graph runs. The expected output is {'number': 21}. The recorded decision grants every action the administrator selected, so the whole graph runs in this one execution. The review shows Runtime proof and Entra exchange as Verified and the decision as Applied. A test2.py changed after the decision was recorded reports pending again with a new review and a Stale decision card. Check Agentic → Activity → Runs for the recorded execution. Keep the same URL spelling, agent name, reporting key and durable runtime-key storage between runs. The SDK normally uses the OS keyring where available with a protected file fallback under ~/.deepintshield/runtime-keys; replacing the key requires fresh authorization.

Another agent can be created and assigned Gateway.Invoke from DeepintShield using this authorized connection. Microsoft administration is still needed for tenant/blueprint changes, permission changes or credential renewal. Human SSO onboarding is separate from agent provisioning.

Later: hosted gateway or cloud-hosted SDK. After deploying the updated gateway, change the SDK URL to https://app.deepintshield.com and use that deployment's workspace key and provider/identity records. A separate database is a separate registration context. If that gateway has server runs enabled, the SDK can submit this standalone script for a server run instead of running it on the laptop. In that case, authorize the server runtime key as described in section 11.4.1 instead of a laptop key. The same SDK integration works on a laptop, GCP, AWS or Azure with a persistent approved runtime key and a reachable gateway. Container keys need durable restricted storage. Certificate-based gateway exchange works across gateway clouds; Azure managed identity requires an Azure gateway host. Optional native cloud proof adds provider-specific trust and runtime setup; Approved runtime key · any host proves key possession and is not cloud-host attestation. See https://aidocs.deepintshield.com/enterprise/agent-workload-identity/