Gateco

Permission-aware retrieval through Gateco. Searches a connector (vector DB) for chunks matching the query, then applies policy filtering based on the principal's identity. Only allowed chunks are returned; denied content is never exposed. Supports four search modes: - vector: Semantic similarity (ANN) — default - keyword: Ranked full-text search (BM25/FTS) - hybrid: Combined vector + keyword with configurable alpha weight - grep: Deterministic exact-match (substring or regex) Args: connector_id: Connector (vector DB) to search. query: Search query text. principal_id: Identity performing the request (UUID). Mutually exclusive alternative to email. email: Email address of the principal. When provided and principal_id is absent, the principal is resolved first. top_k: Max results (default: 10). search_mode: Search mode (default: "vector"). alpha: Hybrid weight 0.0-1.0 (1.0=all-vector, 0.0=all-keyword). Hybrid only. pattern_type: "substring" or "regex". Grep only. case_sensitive: Case-sensitive matching. Grep only. end_user_token: The signed-in end user's own identity token (a JWT from the organization's identity provider), if this agent has one. Gateco verifies it and refuses the call if it names a different principal than principal_id/email resolve to. Required when the organization has set subject_verification=verified_token; otherwise optional. Never fabricate or reuse one from another user.

Grounded answer synthesis through Gateco (Growth+ plan required). Retrieves policy-filtered chunks and synthesizes a natural language answer with citations. Denied chunks are never included in the LLM context. Supports vector, keyword, and hybrid search modes (not grep). Args: connector_id: Connector to search. query: Natural language question. principal_id: Identity performing the request (UUID). Mutually exclusive alternative to email. email: Email address of the principal. When provided and principal_id is absent, the principal is resolved first. top_k: Max context chunks (default: 15). search_mode: Search mode — "vector", "keyword", or "hybrid" (not grep). alpha: Hybrid weight 0.0-1.0. Hybrid only. end_user_token: The signed-in end user's identity token, if this agent has one. See gateco_retrieve.

Dry-run access simulation through Gateco (Growth+ plan required). Evaluates what a principal can and cannot access without performing an actual retrieval. Useful for debugging policy configurations. Args: principal_id: Identity to simulate for. connector_id: Optional — scope to a specific connector. resource_ids: Optional — specific resource IDs to evaluate.

List configured connectors in Gateco. Returns connector names, types, policy readiness levels (L0-L4), status, and IDs. Args: page: Page number (default: 1). per_page: Items per page (default: 20).

List identity principals known to Gateco. Returns principal names, emails, groups, roles, and IDs. Args: page: Page number (default: 1). per_page: Items per page (default: 20).

List IdP-synced groups known to Gateco. Returns group names, source identity providers, live member counts (active members only), and IDs. Args: page: Page number (default: 1). per_page: Items per page (default: 20). search: Optional case-insensitive substring filter on group name.

Resolve a principal by email or provider subject ID. Looks up a principal in Gateco's identity store using a human-readable identifier (email) or the provider-native subject ID (e.g. an Okta user ID, Google sub claim, or AWS external ID). Returns principal details including groups, roles, and attributes. At least one of email or provider_subject must be provided. Args: email: Email address of the principal to resolve. provider_subject: Provider-native subject identifier. identity_provider_id: Optional UUID to scope the lookup to a single identity provider.