Skip to main content
Before anyone in your organization can point an AI agent at the gateway, an administrator decides which applications are in scope and what agents are allowed to do in them. This is a one-time setup per application, and it applies to every agent and every user.
Only Oleria Administrators can enable applications or set gateway policy. View role permissions.

​
Open the gateway console

In the admin portal, at youroleriainstancename.oleria.io, go to Governance -> Oleria AI Agent Gateway. The console is organized into tabs: Oleria AI Agent Gateway console on the OAuth Access tab, showing the application catalog with Enabled checkboxes

​
Enable an application

Applications are disabled by default. Nothing reaches an application through the gateway until you enable it.
1

Find the application

On the OAuth Access tab, search for the application by name. The catalog lists every application the gateway supports, with its category under App Type.The application catalog filtered to SharePoint, showing its app type and the Enabled checkbox
2

Enable it

Select the checkbox in the Enabled column. The change takes effect immediately - users can now connect the application to their own account, and agents can reach it once a user has connected it.Clearing the checkbox blocks the application again, for everyone, without anyone having to disconnect it.
3

Open its policy

Select the application’s row to open its policy panel, then set the controls described below.

​
Set the application’s policy

Each application has its own policy panel, covering what happens when an agent attempts a high-impact action and any custom rules you add on top.

​
Risky operations

Risky operations are the high-impact actions the gateway recognizes for an application - deleting a site, deleting an item, changing permissions, writing a file. Each one gets a decision, which the gateway evaluates before the action reaches the application. Choosing Ask reveals an Approver field. Set it to the requester’s manager, or to a specific person who should decide. Risky operations with Write file set to Ask and its approver set to Manager, above the Rego editor and Save button
A denial is returned to the agent as a refusal, not a silent failure. The agent is told the action isn’t permitted, so it can report the outcome to the person who asked for it rather than retrying blindly.

​
Custom rules (Rego)

Risky operations cover the actions Oleria has modeled for each application. For anything else, write custom allow and deny rules in Rego. Use custom rules when the decision depends on the details of the call rather than the action alone - for example, denying a push to a protected branch while allowing pushes everywhere else:
Select Validate to check the rule before saving. Validation catches syntax errors and rules that could never match, so a broken rule can’t be saved and silently stop enforcing. When the policy is right, select Save. It applies to the next call each agent makes - agents don’t need to reconnect.

​
Make the gateway available in your AI tools

Enabling an application decides what agents may reach. Your AI tool still needs to know where the gateway is. Most AI tools let an administrator publish a connector once for the whole organization, so members find it already listed instead of pasting a URL themselves. In Claude, this is done by a Claude organization administrator, separately from Oleria.
1

Open your AI tool's admin settings

In Claude, go to Admin settings -> Connectors, under Libraries & Access.The Libraries & Access group in the Claude admin settings navigation, with Connectors selected
2

Add the gateway as a custom connector

Select Add, then Custom -> Web.The Connectors page in Claude admin settings with the Add menu open, showing Custom expanded to Web and DesktopIn Connector details, name the connector - this is what members see in their connectors list - and enter your gateway’s MCP endpoint:
The Connector details dialog showing the connector name and the gateway MCP endpointThis endpoint is the same for every Oleria production tenant - there is nothing tenant-specific to substitute.OAuth Client ID and OAuth Client Secret, under Advanced settings, are optional. Leave them empty unless Oleria has given you values to use.
3

Leave authorization to each member

Under Authentication, turn on Browser sign-in. Each member signs in to Oleria themselves the first time they use the connector, so the gateway acts as that person - with their permissions and their connected applications. Publishing the connector does not grant anyone access on its own.The Authentication section of the Connector details dialog with Browser sign-in turned onManaged authorization is the alternative, connecting members through your identity provider instead of a browser sign-in.
Members can also add the connector themselves if you’d rather not publish it centrally. Either way, each person authorizes it individually. See Connect and use your AI agent.

​
Review what agents are doing

The Activity tab is the audit trail for the whole organization. It records every call that passed through the gateway - the time, the user it ran as, the agent, the session, the application, and the exact action attempted. Activity tab in the admin console, listing gateway calls across the organization with time, user, agent, session, app, and action columns The User column is what separates this view from the one people see in the Governance App. Because agents act as the person who connected them, every entry ties back to a named person and a session rather than to a shared token. Connections and disconnections are recorded alongside API calls, so the trail covers how access was obtained as well as how it was used. Use it to confirm a new policy is having the effect you expect, and to investigate anything unexpected. Each person sees only their own activity in the Governance App - see Connect and use your AI agent.

​
Contact us

For questions, contact us at support@oleria.com.