Three genuinely different products are sold under one phrase. Buying the wrong shape is expensive, and the feature lists all look similar enough that it's easy to do. Here's the distinction that actually decides it — and where we don't fit.
The three shapes
These sit in front of the action. Every command, file access, or tool call is evaluated against policy before it executes and returns allow, ask, or deny. Exemplar's Relay is exactly this shape; Obot's MCP gateway routes agent access through a governed control plane.
The value is prevention. A call that violates policy never happens, which is the only way to guarantee an agent cannot touch production or exfiltrate a secret.
Pick this if your requirement is phrased as "this agent must never be able to do X." Prevention at the boundary is a gateway's job and it does it in real time, which nothing downstream can replicate.
These manage the artifacts a regulator asks for: a registry of AI systems, risk assessments, policies, conformity documentation for the EU AI Act and ISO 42001, and automated evidence collection across tools you already run.
The buyer is usually GRC or compliance rather than engineering, and the deliverable is a defensible file, produced on a schedule, for an external body.
Pick this if your obligation is producing and maintaining compliance documentation for a regulation. That is a real, specific job and an operational ledger does not do it for you.
These sit around the work. Not "was this call permitted" and not "is our paperwork in order," but: what was attempted, what evidence supports it, who approved it, what it cost, and can any of that be altered afterwards.
Provostry governs initiatives and work packages rather than individual calls. Completion is attested by CI rather than self-reported by the agent. Budgets attach to work and stop it at the ceiling. Approvals resolve to a named human. The whole record is append-only and hash-chained, and it self-hosts fully air-gapped.
Pick this if the question you'll eventually have to answer is "was this work actually done, who said so, and can you prove it a year from now?"
Side by side
| Question | Gateway | GRC platform | Work ledger |
|---|---|---|---|
| Blocks a disallowed call before it runs | Yes — core function | No | No |
| Produces regulator-facing conformity docs | No | Yes — core function | No |
| Records who approved a specific piece of work | Approvals on calls | Yes, on artifacts | Yes, per work item |
| Completion attested independently of the agent | Not applicable | Varies | Yes — CI attests |
| Record is tamper-evident, not just access-controlled | Varies | Varies | Yes — hash-chained, signed |
| Budget stops work rather than reporting overage | Cost routing / caps | No | Yes — escalates at ceiling |
| Runs fully air-gapped | Varies | Varies | Yes — no phone-home |
Competitor rows describe each product's own published positioning, checked August 2026. "Varies" means we could not verify it from public material and did not want to guess. Products change — check theirs directly: Exemplar · Trail · Obot.
The honest part
The temptation in a page like this is to argue that one shape subsumes the others. It doesn't, and pretending otherwise would fail on contact with anyone who has actually deployed this.
A ledger cannot stop a call. If an agent should never be able to write to your production database, a record saying it did is not a control — you needed a gateway. A gateway cannot tell you whether the work was any good. It permitted a thousand calls; that says nothing about whether the feature shipped, whether anyone verified it, or what it cost. And neither one produces your EU AI Act file.
Questions
Test it
We publish the criteria we think this category should be judged on, including the ones we'd fail. Run them on us.
Six things a governance system must prove →Related: audit trail for AI agents · budget controls · self-hosting.