A finished answer to agent governance — and no front door.

Public quickstarts, SDKs, or API docs found on any Station70 property. The strongest policy story on the market is sitting behind a contact form. That zero is the entire DevRel opportunity.

The one scoreboard — product-shape facts only.

No traction, funding, or customer figure appears anywhere in this proposal — those are instrument, never invented. To a security buyer, a candid zero beats a soft claim.

Why now: two clocks, one window.

• The product clock — the engine governs real agent traffic today. In a live dogfood an agent connected a service, hit the deny-by-default wall, cleared a policy decision, and completed a real call.
• The category clock — agents are crossing from demos into production, and MiCA + DORA became enforceable July 1, 2026: regulators are "no longer asking for the plan… asking for proof it ran."
• The window is the gap between them: the engine is ready, the demand is arriving — and the developers who would wire agents through it have no way in.

Whoever publishes the first credible agent-governance quickstart sets the default teams reach for.

The company is mid-pivot — and nobody owns the story.

• The main site's Gatekeeper page still tells the earlier story: a transaction firewall built with Cyvers.AI, a hosted cosigner for Fireblocks customers.
• The new subdomain tells the AI story: "The Credential Layer for AI" — an MCP-native credential firewall where the LLM never sees the credential.
• A prospect gets two different narratives depending on where they click.

Showing up now with docs, a quickstart, and one coherent developer narrative isn't decorating a finished story — it's writing it.

The wedge: connected ≠ allowed.

Every agent request is evaluated in real time against a stacked, deny-by-default policy — twelve dimensions, org over user — the secret released from a zero-knowledge vault only as a scoped, time-bound injection for that one call, high-blast-radius actions escalated to a human quorum, every decision in an audit trail.

Not raw per-service OAuth, not a convenience-first tool gateway, not DIY policy — and in Station70's own frame, not a password manager or enterprise PAM: "built for AI, not retrofitted from humans."

Field notes: proof-of-work, not promises.

• First real call: policy denied: no policy decision — on a connected service with broad scopes. Correct security, missing onboarding.
• Signal mode returns HTTP 200 with approval_required + connect_url instead of a hard 401 — a headless agent keeps its context, polls, and auto-resumes on approval. Designed for agents.
• The moment a policy allowed it, a real query round-tripped with the raw secret never leaving the vault and the whole decision in the audit trail.

The demo writes itself: agent exceeds scope → denied → human-approved → succeeds.

Honest read.

• S · Custody-grade credibility: zero-knowledge architecture, a Trail of Bits cryptography audit, SOC 2 Type 2, hardware-attested enforcement.
• W · Zero public developer surface, a deny-by-default onboarding wall, and logos but no case studies.
• O · The governance quickstart is unclaimed greenfield, and MCP standardization is untapped distribution.
• T · Tool-gateway incumbents own developer mindshare; platforms could ship "good enough" guardrails.

The category is trust — candor is the marketing.

One north star.

Weekly active agents completing policy-evaluated calls through Gatekeeper — calls that pass both the org policy stack and the user policy stack and complete successfully — weighted toward approval-gated and spend-capped calls.

Refused vanity metrics: signups, connectors configured, registered agents, page views, GitHub stars. Every baseline is instrument — measured once live, never asserted.

Seven initiatives, each bolted to a lever.

• 1 · Security & governance proof series — the trust engine
• 2 · "Connect your first service in 5 minutes" — the activation on-ramp
• 3 · Framework-native distribution
• 4 · Reference architectures — one per harness × service
• 5 · Office hours, build-in-public, unblock channel
• 6 · Design-partner cohort — white-glove for references
• 7 · MCP registry + marketplace presence

The load-bearing three.

• The proof series pre-clears the security review — a public, re-runnable harness told in real Gatekeeper MCP calls, so a skeptical security engineer reproduces the enforcement instead of trusting a screenshot.
• The activation on-ramp attacks the wall the dogfood hit — time-to-first-policy-evaluated-call is the number the pilot instruments.
• The design-partner cohort manufactures the missing references on a calendar — 12 weeks, 8–10 companies, each committing up front to a case study, a quotable result, and a public Demo Day.

Program roadmap: three arcs, six releases.

• Fix & Activate — v0.1 Truth & Baseline · v0.3 Prove the Wedge
• Scale the Loop — v0.5 SDKs & Framework-Native Distribution · v1.0 Retain & the First Cohort
• Monetize & Compound — v1.3 Enterprise Controls (hard-gated on [paid-tier GA / self-serve signup live — to confirm with Station70, G7]) · v2.0 Managed Services & Compounding

One non-vanity KPI and one exit gate per release — no release ships on vibes.

DevRel that pre-sells revenue.

Not a top-of-funnel awareness play — a proof factory feeding the existing sales-led motion.

• A technical champion created and equipped inside the account.
• A Gatekeeper-specific reference the deck can finally name.
• Attributed pipeline: dabl.club UTM click → account resolved → first policy-evaluated call → sales opportunity.

The developer motion doesn't replace the enterprise sale. It feeds it.

An audience on day one.

developers at dabl.club — an owned, attributed acquisition channel Colin already operates. Instant top-of-funnel most startups spend a year building.

Two commercial frames — kept separate on purpose.

• Frame 1 · The flat-hourly pilot (primary CTA): Pilot $6K / 1 month → Standard $36K / 3 months → Embedded $90K / 6 months, plus a performance option (swap up to ~30% of the retainer for per-activation fees).
• Frame 2 · The founding-hire path: Door A full-time Head of DevRel · Door B 90-day paid pilot → convert (≈ $155K for 90 days) · Door C fractional with OKRs.

Full 12-month build ≈ $1.6M; startup-friendly ramp ≈ $900K–1.0M. The managed-services upsell turns the motion self-funding.

Why Colin.

• dabl.club — ~85,000 developers of earned reach, the attribution engine behind every promise in this deck.
• A repeatable DevRel operating system — authored for Tenki, AISA, Nebius, and Coral; shipped for CrewAI, Memori, Glean, and Perplexity.
• First-hand field notes — a real dogfood of the live Gatekeeper MCP tools: a real denial, real reauth friction, a real completed call.

Conflict disclosure up front; fee and program budget always quoted as separate lines.

One yes.

Scope the pilot: a one-month, $6,000 fractional engagement that stands up the activation instrument, ships the flagship "connect your first downstream service through Gatekeeper in 5 minutes" quickstart, and reports one honest activation number.

Small enough to approve without a committee. Self-terminating on a measured baseline. The first move is one 30-minute call — everything larger is a renewal decision made after the number exists.