Give work the access it needs,
keep the authority in view.
Recent decisions
Authority active · 64%
Billing API request
Lease · build agent
A minute ago
Development policy
Exact HTTPS origin · active
Earlier today
GitHub assignment
Human member · expires in 6 days
Access decisions still vanish into tools. Teams need to know who can act, under which authority, and what happened after a change.
Qevra puts authority and evidence in one place. Gateway mediates use of a restricted development credential. Access manages time-bounded provider memberships for people, with the remote result tracked separately.
A record that follows every decision.
Gateway records the request, its policy decision and its outcome. Access keeps the assignment, its deadline and the latest provider observation distinct, so an administrator can inspect what Qevra authorised and what the provider did. Learn more
Billing API requestAllowed · exact originInspect
Destination policyPolicy updated · development
Engineering teamAssignment · GitHub team
Revoked LeaseDenied · 2 weeks ago
Decision found: Billing API request, made by the build agent yesterday. The record shows the policy verdict, bounded authority and upstream outcome.
- Lease issued · expires in 30 minutes
- Agent made a request
- Gateway evaluated policy
- Decision Record committed
Request admitted for the build agent under the active Lease.
For teams giving people and agents bounded authority
Grant it, check it, observe it.
One view.
Gateway governs mediated credential use. Access governs existing provider membership for people. Both make the authority, deadline and outcome visible to an administrator.
- Let the build agent call the billing API for this run
- Billing API requestAgent Principal
- Policy · exact pathGET /v1
- Lease · 30 minPOST /v1
Lease active · 18 minutes left64%Issue a short-lived Access Lease. Gateway checks policy before decrypting and records the decision before forwarding.
- Give a teammate GitHub team access until Friday
Acme is requesting
Existing team · engineering
Review assignment
Human principal only
- Jonas · member
- Lena · member
Grant access to a named person. Access selects an exact provider target and role, then records the remote observation.
- Review the exact target before granting
From Acme organisation
Engineering team
Assignment · 7 daysProvider observedReview the target first. Revocation ends Qevra authority immediately. Remote removal remains visible until observed.
Every action has
an authority chain.
- MP4
- MOV
- ProRes
- RAW
- DNG
- PSD
- AI
- INDD
- ZIP
- WAV
- MP3
- FBX
- OBJ
- TTF
- SVG
- PNG
- TIFF
- KEY
- XLSX
- JSON
- ISO
- FCPX
- GLB
Human, agent and service principals are explicit concepts in Qevra. A Gateway Lease is never a provider assignment; a provider assignment never carries a Gateway token. The record keeps those boundaries inspectable.
Why Qevra
Authority is how work moves. A credential, a team membership, a deadline. Every one of them should have a named owner and a visible result. Qevra keeps that chain clear from grant to decision to observation.
Clear enough for the access that matters.
Client contracts, unreleased cuts, payroll exports. Qevra treats every transfer like it's the sensitive one.
- Encryption256-bitCipherXChaCha20Key heldYour deviceAt restAES-256
Encrypted at rest. The imported development credential stays encrypted. Gateway decrypts only after the request is authorised.
- Policy limitsPolicyRequiredExpiresIn 7 daysRequestsUp to 25
Controls per grant. A principal, exact destination and bounded lifetime are explicit before a Lease is issued.
- Access logTodayagent@acme.exampleAllowedOutside policy · deniedBlockedmember@acme.exampleViewed
A record for each decision. See the principal, policy verdict, upstream outcome and recorded time as separate facts.
- Data residencyFrankfurt · EUPinnedVirginia · USSingapore · APAC
Run with a clear boundary. The Gateway proof uses one managed region and one exact public HTTPS origin.
See the authority boundary at a glance.
Illustrative comparison of authority patterns. These bars demonstrate the layout, not measured product performance. Learn more
- Qevra96 MB/s
- Direct token71 MB/s
- Shared secret58 MB/s
- Static key44 MB/s
- Manual access4 MB/s
One place for people, agents and their authority.
Organisations contain projects and a development environment. Keep the principal, credential binding, entitlement, lease and latest decision in context.
- Bounded authority for each principal
- Exact destinations and time limits
- Decision and observation remain visible
Less guessing. More clarity.
“We used to send a 40 GB master and then spend the afternoon confirming it arrived. Now the receipt shows up before I've closed the tab.”
Start with the proof. Grow with the work.
Gateway and Access are separate products in one control plane. Talk with us about the right pilot scope for your team.
Pilot
Explore a bounded Gateway proof.
01workstream
Explore Qevra- Human and agent principals
- Time-bounded Entitlements
- Short-lived Access Leases
- Private Decision Records
Gateway
Core productMediate development credential use.
02workstream
Scope by request
Explore Gateway- Restricted development credentials
- Exact HTTPS destination policy
- Server-side credential injection
- Gateway policy enforcement
- Revocation target in one region
- Decision and outcome records
Access
Manage named provider assignments.
03workstream
Scope by request
Discuss Access- Existing human members
- Named provider target and role
- Fixed assignment deadline
- Separate provider observation
- Local authority ends on revoke
- Removal tracked until observed
Everything to know before granting.
Need to discuss your access boundary? Write to the Qevra team.
Gateway mediates credential-backed HTTP requests. Access administers existing provider membership for named people. They have separate authority and evidence.