Skip to main content
One file describes a gateway. It is validated at startup, and anything questionable is reported as a warning rather than silently accepted.

​
Top level

​
integer
required
Must be 1.
​
string
default:"127.0.0.1:9470"
Address to serve on. A non-loopback address without TLS is refused unless allow_insecure_listen is set — agent keys and operator tokens travel in every request.
​
string
required
At least 16 characters. Keys deterministic masking, so the same value always produces the same token. Treat it as a secret: it is what stops a token being reversed by anyone who can guess inputs.
​
string
Where the append-only journals live. Without it, state is in memory and a restart loses the audit chain — the gateway warns at startup.
​
object
cert and key, as PEM file paths. Both or neither.
​
boolean
default:"false"
Permit plaintext on a non-loopback address, for when TLS is terminated in front of Warden. Warns loudly.
​
object
ttl, max_ttl, max_lifetime as Go durations. A term longer than the ceiling above it is a configuration error rather than something silently clamped. See leases.

​
connections

​
string
required
Unique. Agents and policies refer to it.
​
string
required
postgresql, mongodb (also accepted as mongo), neo4j, or memory. See engines.
​
string
required
The database credential. It exists here and nowhere else — no agent ever sees it. Use a least-privilege role.
​
string
required
Path to the policy file, resolved relative to this file. See policy.
​
object
mode is blocking (default) or async; async_timeout bounds how long a proposal waits. See approvals.
​
map
Engine options. For PostgreSQL: schemas (which to introspect — without it the catalog becomes a map of the database), statement_timeout_ms, max_conns, application_name, and lease_role (the base role each lease’s own database role joins — see a role per lease). For MongoDB: database (required — refused when empty rather than inferred silently), collections (which to introspect), statement_timeout_ms, max_pool_size, application_name — see MongoDB. For Neo4j: database (default neo4j, the only database Community serves), labels (which to introspect), statement_timeout_ms, max_conns, application_name — see Neo4j.
​
object
Starting data for the memory engine, ignored by every other engine. Makes a demo one command rather than a setup script.

​
agents

​
string
required
The identity that appears in every audit record, conventionally agent:name.
​
string
required
Which connection this agent may use. One each.
​
string
required
The hash of the agent’s key — warden keygen prints both halves. key: accepts a plaintext key for development, and the gateway warns, because the config file then is the credential.
​
map
Scope values bound into every operation, such as tenant_id: acme. The policy decides which fields these bind to; this says what this agent’s values are.

​
operators

​
string
required
Shown as the reviewer in audit records and in the agent’s response. Use something that identifies a person.
​
string
required
owner, operator, reviewer, or read_only. Roles carry capabilities: reading, reviewing (approve, reject, revoke a lease), and managing (freeze an agent, start a debug session).
​
string
required
As with agents, token: is the development-only plaintext form.

​
Checking it

Startup prints the capability ladder per connection, the state directory, recovery notes from the journals, and every warning. A connection that cannot meet its policy stops the process.