Use cases
Copy a worked SecureAuth Agent Authority example to control what agents can do, or see what they already did
You have agents connected, and now you need to decide what they can do, or find out what they already did. Each walkthrough here starts from one of those questions and ends with a rule you can copy into your own gateway, or a screen that answers it.
Control access
Give Claude read-only access to Jira
Claude answers questions about your issues but can't file, edit, comment on, or move them. One rule names the read tools, and every write tool stays blocked.
Block GitHub merges and file writes
The agent opens and updates pull requests but can't merge one or write files straight to a branch. The deny rule covers the tools that merge a pull request or change files on a branch.
Limit an agent to one Slack channel
The agent reads and posts in one channel and nowhere else. Naming the tools isn't enough, because each Slack tool works on any channel the person can reach.
See activity
Investigate agent activity
Something changed and you need to know which agent did it. Finish at one Agent Trail entry naming the agent, the person it acted for, and the rule that allowed it.
Track token spend by team
See what each team spends on Claude and Codex, then follow the same team filter into the tool calls behind the cost.