The runtime and the rules
Where the agent runs, which model and tools it uses, the policy it obeys, and the upstream credential it never hands to a person.
People sign in with your identity provider and use the agents you approved. Every call goes through Gateway.
The workforce path
Sign in, find an agent, use it where you work.
Nobody holds the upstream credential. Every call leaves a record.
- 01Sign in
Your identity provider supplies the person, tenant, team, and role.
OIDC · TEAMS - 02Find
People see the approved agents assigned to their team, with a clear job and contract.
CATALOG - 03Get access
Access arrives by role, or on request with an owner's approval.
SCOPED ACCESS - 04Launch
Use the agent through Gateway today, over HTTP or MCP. Slack, Teams, IDE, and command-line delivery are part of the Workforce Portal being built.
HTTP · MCP
The model
The company runs the agents. Nobody brings their own.
Zerker connects agents that already run somewhere: an internal service, a Claude Code or Codex session, a model provider, an MCP server, a vendor agent. Gateway sits between your people and those agents.
Rollout
From scattered agents to one governed set.
Most companies already have agents spread across teams: ChatGPT and Claude, Cursor and Claude Code, a sales research agent, Slack automations, and things individual engineers built. Zerker starts by organizing what exists.
- 01Connect identity
Okta or Google Workspace supplies people, teams, roles, business units, and access groups.
OIDC - 02Build the inventory
Import or register each agent with its owner, runtime, and users.
CATALOG - 03Assign owner and policy
Who owns it, who can use it, what it can reach, which actions need approval, and its cost limit.
POLICY - 04Connect the runtime
Register an API-backed agent's endpoint and credentials, or add an adapter to a local one.
ROUTE - 05Label what you cannot route
An agent that does not pass through Gateway is shown as observed, never as governed.
OBSERVED · GOVERNED - 06Publish to the workforce
People sign in, see the agents assigned to their team, and launch them where they work.
DELIVER
Status
What works today. What we are building.
Gateway governs workforce traffic today: identity, tenant boundaries, policy, protected credentials, and a record of every call. The Workforce Portal, where people find and launch agents, is being built on those records. Only calls routed through Gateway are governed.
Sequence
Workforce first. Then partners. Then customers.
Start with your own people. Extend selected agents to partners. Publish the ones that are ready to customers through Agent Portals.
Start with one team and one approved agent.
Connect your identity provider, register the agent, and give one team access through Gateway.