STOA is the gateway between your AI agents and existing APIs. Your teams define access permissions and can trace API calls.
Code published under Apache 2.0 · Documentation available
An overly broad key can expose more data than the task requires.
The lookup is allowed. The change is denied and explained.
Illustrative comparison. No real requests.
AN EXAMPLE: SUPPORT ASSISTANT
An assistant needs to look up an order. See how the gateway limits its access and explains a denied attempt to change customer data.
01 / A CUSTOMER REQUEST
The assistant answers an order-status question. An overly broad key would also let it change customer information.
The risk comes from access that goes beyond the task.
Look up the order
How do you give it what it needs without opening everything else?
02 / A DEFINED SCOPE
The chosen scope lets the support assistant look up orders.
In this scenario, changing customer records stays outside its scope.
03 / TWO ACTIONS TO TRY
Try looking up an order, then editing a customer. See where the boundary lies.
The simulation checks the requested action against the access granted.
TRY IT YOURSELF
Reading orders is within the access granted to the support assistant.
Try a lookup, then a change.
04 / AN EXPLAINED DECISION
A trace brings together the assistant’s identity, the requested action and the access decision.
The trace explains the result of the selected action.
Access can be explained, not guessed.
Step01 / 04
Illustrated scenario. No customer data or real requests.
STOA helps platform teams and developers expose their APIs to AI agents, with defined permissions and visibility into calls.
Connect each consumer to the services and actions it is allowed to use.
Authentication and authorisation rules determine access to exposed services. Their configuration depends on your architecture.
Place a gateway between agents and the services you expose, with a control plane for the catalogue and rules.
Plan the integration around your protocols, hosting and identity mechanisms. The documentation describes the components and prerequisites.
Find call results and context to distinguish denied access from a service-side issue.
Logs, metrics and traces help explain a call’s path. The level of detail available depends on the configuration.
The gateway handles calls. The control plane manages the catalogue and policies. Agents and applications can then access your APIs through a defined entry point.
Explore the architectureStart with a first call, see where the gateway fits in your system, then examine the code.
With your permission, we use cookies to measure visits and understand navigation so we can improve the site.
