Filesystem confinement
Only the conversation workspace and its dedicated runtime state enter the rootless container.
Confinement is the product
Give agents capability without giving them everything.
Agents are useful because they can act. ChannelGate makes that action explicit: every conversation has an isolated runtime, approved people, selected tools and a visible operating mode.
Per-channel policyContainer boundaryAuditable control
What this enables
Built for real company work.
Explicit authorization
Approved users, guests and administrators have distinct, inspectable rights.
Tool governance
Modes, MCP connections and skills are granted at the channel boundary.
Accountable operation
Approvals, work history and administrative changes remain reviewable.
Security documentation
Read the threat model and operating guidance in the public repository.
Explore security documentation →Self-hosted by design
Your infrastructure. Your workspace. Your operating boundary.
ChannelGate runs the agent inside a conversation-specific rootless container. The hosted customer platform issues licenses; configuration, credentials, work and history remain with the deployment you operate.
Put it to work