NautsAI software & research
Back to NautGate

NautGate / Guide 1 of 3 / 3 min read

Why NautGate? Start with the question.

I built NautGate after a simple question became impossible to ignore: what is my LLM actually doing?

The reason

I wanted to know what my LLM was actually doing.

The same model could feel different from one week to the next. I wanted a record I could inspect instead of guessing what had changed.

NautGate grew from that monitoring tool into a gateway for connected applications and agents. It records their usage, controls model routes and can produce signed evidence for later inspection.

48Nauts / Product guides

The question that started it

More than a year ago, the same LLM workflow began to feel different from week to week. Costs moved, outputs changed and behaviour did not always match what I expected. I could see the answer, but not the path that produced it.

I did not have a name for every failure mode then. I only knew I needed to see the model, route, usage and cost behind a request before I could decide whether anything had drifted. That first monitoring tool grew into NautGate.

Make the path visible

NautGate puts a routing and recording point between a connected application and its model providers. It lets you investigate the activity that passes through it: which application made the request, which route handled it, which model the provider reported, and what usage, latency and cost came back.

This is deliberately narrower than a claim to see all AI activity. A gateway cannot observe an application that bypasses it, and a provider-reported model identity is not an inspection of model weights. Coverage has to be designed, tested and reviewed.

Use compliance as a baseline, not a slogan

The EU AI Act is risk-based. Using an LLM does not by itself make a system high-risk. An organisation first needs to establish its role, intended use, system classification and the provisions and dates that apply to that use.

Article 4 addresses AI literacy for providers and deployers. For high-risk AI systems, Articles 12, 13, 14 and 26 address logging and traceability, information needed to interpret logs, human oversight, monitoring and deployer log retention. Those overlapping needs made the monitoring tool worth developing further.

NautGate can help create and inspect records for connected traffic. It does not classify a system, complete a risk assessment, determine legal duties or establish compliance. Treat it as one technical control in a wider governance, privacy and operating model.

Observe without sending more than necessary

The next question is what leaves the organisation with a request. Monitoring should not become a reason to retain or forward every prompt and response. Recording scope, retention, access and deletion need explicit decisions.

That is why Bowden-PII sits beside NautGate. Bowden reduces supported personal identifiers locally before text is sent onward, while the application keeps the original-value mapping separately. It is a data-minimisation step, not a guarantee of anonymity or a replacement for privacy assessment.

The thread is simple: understand what the system does, decide what it may send, then keep only the evidence needed to investigate and govern the connected workflow.