One control layer for people and agents alike

Auth, Secrets, Connect and AI Gateway are four products that answer four questions about every action on your business: who is acting, what it can reach, what it can touch, and which model runs it. Each can be subscribed to on its own and run over whatever stack you already have.

Most companies buy AI tools first and work out governance afterwards. We built the governance first, because our own fourteen platforms depend on it. If you cannot say which agent did something, under whose authority, with which key, you do not have an AI strategy — you have exposure.

Who is acting?

Auth

auth.calimatic.com

Every action on your systems is taken by someone — a person or an agent. Auth is the one place that says who, and what they are allowed to do, across every product they touch.

  • One identity for people and for agents
  • Roles and permissions that hold across every product
  • Multi-tenant from the ground up
  • OIDC and SAML ready

Subscribe to Auth on its own and run it over the stack you already have.

A request through Authrefund-assistant
  • Request arrivesagent:refund-assistant · tenant: northside-academy
  • Identity verifiedknown agent, bound to a human owner
  • Scope checkedbilling:read, billing:refund · denied: student_records
  • Allowed to proceedwithin scope, logged against the owner
What can it reach?

Secrets

secrets.calimatic.com

An agent that needs to touch Stripe or a database needs a key. Secrets hands out scoped, short-lived credentials instead of shared keys sitting in an environment file.

  • Scoped, short-lived credentials, not shared keys
  • AES-256-GCM encryption at rest
  • Rotation built in
  • An audit trail for every issue and every use

Subscribe to Secrets on its own and run it over the stack you already have.

A request through Secretsrefund-assistant
  • Credential requestedrefund-assistant needs stripe_key
  • Scope appliedrefunds only · no customer export
  • Short-lived token issuedexpires in 300s, then useless
  • Use recordedevery issue and use in the audit trail
What can it touch?

Connect

connect.calimatic.com

Connect is one integration hub to 200+ providers — payments, calendars, CRM, storage, messaging. Grant an agent a system once, and revoke it in one place.

  • One hub to 200+ providers
  • Payments, calendars, CRM, storage and messaging
  • Grant a system once, reuse it everywhere
  • Revoke access in a single place

Subscribe to Connect on its own and run it over the stack you already have.

A request through Connectrefund-assistant
  • System grantedrefund-assistant → Stripe, once
  • Action takenrefund issued · parent notified
  • Reused everywheresame connection, every Calimatic product
  • Revoked in one placecut access across the board instantly
Which model, at what cost?

AI Gateway

ai.calimatic.com

A single endpoint across model providers. Each workload routes to the model that clears it most cheaply, with caching, spend limits and full usage records.

  • One endpoint across providers
  • Cheapest-model-that-clears-it routing
  • Response caching
  • Spend limits and full usage records

Subscribe to AI Gateway on its own and run it over the stack you already have.

A request through AI Gatewayrefund-assistant
  • Workload arrivesclassify this refund request
  • Model routedcheapest model that clears the task
  • Cached where possiblerepeat work does not pay twice
  • Spend recordedper workload, against a limit

Run the control layer over your own stack

You do not have to move to Calimatic to govern your agents. Subscribe to the control layer and run it over whatever you already have.

See Agent Readiness