Permaura Client Gateway Provisioning (Onboarding)

Permaura Client Gateway Provisioning (Onboarding)

1. 01

   Create a dedicated workspace per client in Permaura

   The Free plan caps you at 1 workspace and Pro at 3, so map workspaces to clients before you start. If the agency book exceeds 3 concurrent client gateways, price the Team plan at $19 per seat into the retainer rather than sharing one workspace across accounts.

2. 02

   Deploy the gateway and store client credentials inside it

   Choose a local open-source gateway or a Permaura-hosted gateway. On Free you bring your own tunnel; Pro adds 1 hosted gateway, a managed permaura.app address, and remote access to your gateways. Load the client's Stripe, GitHub, HubSpot, or Slack keys into the gateway so the assistant never holds them.

3. 03

   Connect one MCP-compatible assistant to the gateway

   Register Claude, ChatGPT, Codex, or Cursor against the gateway. Start with a single assistant on a single client workflow so approval behaviour is observable before you widen scope.

4. 04

   Define per-connection rules for the sensitive workflow

   For each connection, set the policy to allow, require approval, or deny. Refunds in Stripe and outbound messages in Gmail should sit on require approval; read-only lookups can sit on allow. Deny anything the client has not explicitly signed off on.

5. 05

   Enrol the client's approvers on device-signed approval

   Bind approval to the client's phone, desktop, or Apple Watch so a sensitive action cannot clear without a device-signed confirmation. Confirm at least two named approvers per client so delivery does not stall when one is unavailable.

6. 06

   Verify the signed audit trail before handoff

   Run one test refund or message through the gateway and confirm the request, the decision, and the approver are all written to the signed, linked audit trail. Export a sample record into the client handoff pack as evidence the control works.

7. 07

   Hand off with a written approval policy and escalation path

   Deliver the connection list, the allow/approval/deny matrix, and the named approvers to the client. Note the gateway hosting model (local tunnel versus hosted) so the client knows who owns uptime on the retainer.