Concepts
How it fits together
What Immiscible does, the six pieces it is made of, the four ways an agent reaches the gate, and the conventions these docs use.
Immiscible is not an agent. It sits between your agents and anything consequential they do, so a model request, a payment or a tool call is decided against rules a person wrote. This page is the map; each piece links to its own page.
#What it does
The gateway is where spend becomes something you can control. Change one base URL and every model request is metered, checked against your budgets before the call, and recorded with what it cost. A new workspace starts in shadow mode: nothing is rerouted or refused, and Immiscible records what it would have routed to and at what price, so an estimated saving becomes a measured one before anything changes. Discovery lists the provider keys your people run outside it, with each owner and what it spent.
Before an agent pays, releases personal data, sends a message or calls a tool, it asks Immiscible, and the answer is allow, deny or approval_required, with reasons a person can read (decisions). When a person should decide, they are asked in the console, by email, or in Slack or Teams, and the agent waits. Any agent, or all of them, can be stopped at once, with holds that say who may start them again.
Every allowed action carries a signed receipt, and every decision, approval, stop and change of access goes into a hash-chained, signed evidence ledger you can verify offline without trusting us.
#How the pieces fit
| Piece | What it is | Where to read |
|---|---|---|
| Agent | A registered AI agent with an id no AI can change, a sponsor, a purpose and a kill owner | Kill switch |
| Mandate | A signed, standing authority: what the agent may do, for whom, up to what limit, until when | Mandates |
| Autonomy tier | How much the agent may do without a person, earned on evidence: intern, junior, senior, principal | Autonomy tiers |
| Decision | The answer to one action request, with reasons and risk signals | Decisions |
| Receipt | A signed, single-use token proving one action was allowed | Receipts |
| Evidence | The chained, checkpointed ledger of everything above | Evidence |
#Ways in
An agent reaches the gate in one of four ways. Pick the strongest one your agent supports.
| Path | Who calls the gate | Can the agent skip it? |
|---|---|---|
| MCP proxy | Immiscible, on every tool call, holding the tool’s credential | No: the agent has no other route to the tool |
| Card rail | Your card issuer, before money moves | No: the card declines without a receipt |
| Claude Code hook | Claude Code itself, before each tool runs | No: the model does not run the hook |
| HTTP API or MCP server | The agent, when it chooses | Yes, so pair it with one of the above |
#Conventions in these docs
- Amounts are in minor units:
6420is £64.20. - Examples use
https://immiscible.fly.dev, the hosted service, as the base URL. If you run your own server, use its address instead. - Keys and tokens are shown as
ask_...,ims_...andaat_.... Each is shown once when it is made, and never again.