Zero Trust Execution Gateway for PowerShell (ZTEG)

Run PowerShell at scale —
safely, anywhere, by anyone you trust.

PowerGate controls how PowerShell runs in your organisation — whether you're delegating helpdesk tasks, reacting to infrastructure events, or watching and executing across network boundaries. Self-service portal, approvals, full audit trail, remote engines, and event-driven automation in one platform. No shared admin passwords, no open consoles.

View pricing Explore features
Why PowerGate

Give your team superpowers — without giving away the keys

Every IT team has powerful PowerShell scripts. The problem is letting people run them safely. Today that usually means handing out admin consoles and shared credentials, or funneling every routine task through a handful of senior admins. PowerGate is the controlled gateway in between.

Without PowerGate

  • Helpdesk waits on senior admins for routine tasks
  • Scripts scattered across desktops and shares, unversioned
  • Shared admin credentials and wide-open consoles
  • No record of who ran what, when, or with what result
  • Risky one-off changes with no approval or guardrails

With PowerGate

  • Level-1 safely runs curated actions, self-service
  • One governed catalog of approved, versioned actions
  • Least-privilege execution — secrets never exposed
  • Every run audited with output, duration and operator
  • Approvals, scheduling and automation built in

The result: you delegate work down, cut ticket turnaround, remove standing admin rights, and pass audits — while your experts stop being a human API for routine requests.

Built for MSPs & IT service providers Internal IT & helpdesk SysAdmins & automation engineers Security & compliance teams
Use cases

Which challenge fits yours?

PowerGate solves different problems depending on your environment — pick the one that looks familiar.

Internal IT & helpdesk

Your senior admins are the bottleneck for routine tasks

Level-1 staff can't run scripts safely, so everything queues up with the people who know PowerShell.

  • RBAC & self-service portal — staff run only what you explicitly allow
  • Full audit trail — every execution logged with output and operator
  • Approval gates — sensitive actions wait for a human sign-off
Ops & automation teams

Events happen in your infrastructure — nothing reacts automatically

Windows event log errors, files dropped into folders, monitoring alerts — all need a human to notice and act.

  • Event log & file-watch triggers — scripts fire the moment something happens
  • Logic flows — chain reactions into multi-step automated processes
  • Scheduling — run anything unattended on a cron schedule, fully logged
Multi-site & MSPs

Your infrastructure spans multiple networks — one control plane, zero VPN hopping

Segmented sites, client networks, OT/IT boundaries — each with its own events to watch and scripts to run.

  • Remote engines — deploy lightweight agents across any network segment
  • Sensor + executor — engines watch for events and execute scripts anywhere you need
  • Central control plane — manage everything from one PowerGate instance
Security-critical environments

Your environment cannot call home — ever

Air-gapped networks, classified infrastructure, regulated industries. Most tools fail the first filter.

  • Fully air-gapped — no internet required for install, licensing, or operation
  • Zero telemetry — your scripts and data never leave your network
  • Offline license file — no activation server, no phone-home
How it works

Scripts in. Control out.

PowerGate sits between your PowerShell scripts and the people who need to run them — enforcing identity, least privilege and a complete audit record on every execution.

YOU BRING YOU GET Scripts & Actions Credentials & Vault Roles & Permissions Triggers & Schedules PowerGate Core ZTEG Zero Trust · Least Privilege · Full Audit RBAC · Credential Vault · Bundled PS7 MCP · Logic Flows · Air-Gapped No internet required · No telemetry Self-service Portal Full Audit Trail REST API & Webhooks AI Colleague (MCP) WebSocket Remote Engine Site A · Network zone · OT Remote Engine Site B · Isolated segment Windows · AD · Endpoints Windows · AD · Endpoints REMOTE ENGINE ADD-ON · PER SITE
See it in action

Two perspectives. One platform.

A quick look at PowerGate from the helpdesk operator's seat — and from the admin's.

For helpdesk operators

Select an action, enter parameters, execute — full output, no console, no admin credentials.

For administrators

Every run recorded — who ran it, what parameters, full output. The control layer your audit requires.

There is a lot more to explore — approvals, logic flows, scheduling, credentials, remote engines and AI integration.

Let's talk
Capabilities

Everything you need to operationalize PowerShell

Everything you need to operationalize PowerShell automation at enterprise scale.

Multiple Execution Targets

Local runspace, isolated local process, remote machines and full impersonation — pick the right isolation and identity for every job.

Role-Based Access Control

Granular roles decide who can see and run each action. Your helpdesk runs exactly what you allow — and nothing else.

Logic Flows

Chain script actions into multi-step flows with conditions and branching — orchestrate real processes, not just single commands.

Scheduling & Recurrence

Cron-based schedules for recurring automation — backups, clean-ups, reports — running unattended and fully audited.

Remote Engines — Execute & Sense

Push execution out to remote engines across sites and networks. Engines also act as event sensors — they watch Windows Event Logs and file system folders, and automatically fire script actions the moment something happens. All managed centrally from one PowerGate control plane.

An AI Colleague for PowerGate

A knowledgeable teammate that understands your scripts, your runs and your environment. Ask it what's going on, have it look into a problem and explain it, or get it to draft new automation for review — secure, permission-aware and fully recorded. Works with Claude and other AI assistants.

Credential Vault & Impersonation

Store secrets encrypted, pull from external sources, and run as service or domain identities — without ever exposing passwords.

Full Audit Trail & History

Every execution, change and approval is logged with output, duration and operator — complete accountability and traceability.

Git & File Repository Sync

Connect Git repositories — cloud or on-prem — and file-based shares. The sync scheduler pulls changes automatically and creates or updates the matching script actions from each script's metadata, so your action catalog stays in lockstep with your source of truth.

Approval Workflows

Require human sign-off before sensitive actions execute. A request sits in a dedicated approval queue until an authorised approver accepts or rejects it — separating the person who asks from the person who allows, with a full record of every decision.

Dynamic Parameter Scripts

Turn free-text fields into live dropdowns populated from Active Directory, a CMDB, a REST API — any source your scripts can reach. Define a short PowerShell script once and bind its output to any Script Action or Logic Flow with a simple token — no typos, no stale lists.

High Availability

Run PowerGate as an active/passive cluster backed by SQL Server. If the primary node fails, a standby takes over automatically — no single point of failure, no manual intervention, no lost runs.

Event-Driven Automation

From event to action — in seconds

Remote Engines don't just run scripts. They watch your infrastructure and react — Windows Event Logs, file system folders, or both. An event on any machine can trigger automation that runs anywhere.

REMOTE ENGINE A DC01 · Security Log Event 4625 detected CORE PowerGate REMOTE ENGINE B Site B · Alert-FailedLogon ✓ completed REMOTE ENGINE C Core Server · Create-Ticket ✓ completed event signal dispatch to all

One event on Engine A triggers Core to dispatch simultaneously to any number of engines — each Script Action runs on its own configured target. One sensor, unlimited executors.

Orchestration

Logic Flows — turn small scripts into big automations

Write small, single-purpose script actions and chain them into bigger automations — each step a reusable building block you can drop into any flow. Add conditions, branching and foreach loops to keep even complex processes readable and maintainable.

PowerGate Logic Flow — Employee Leaver process: fetch all leavers, then a foreach loop disables each person's account, mailbox and access

Above: an Employee Leaver process built from reusable steps. One action fetches everyone leaving today; a foreach loop then runs the off-boarding steps for each person — wired together once, audited on every run.

Reuse, don't repeat

Write a script action once and use it across many flows. Improve or fix it in one place, and every flow that depends on it benefits.

Troubleshoot in seconds

Each step runs and is logged on its own, so you see exactly which step failed and its output — not one tangled log to dig through.

Transparent by design

The whole process is laid out visually and audited step by step — it's clear what runs, in what order, and against whom.

Dependency Graph

See every dependency at a glance

The built-in Visualize tab maps the full dependency graph of any Script Action — credentials, repositories, triggers, notifications, approval gates and dynamic parameter scripts — in one view.

svc-helpdesk Credential IT-Scripts (Git) Script Repository 3 Parameters Script Parameters gets syncs from accepts Disable-ADAccount LocalRunspace fires notifies 0 8 * * 1-5 Schedule Trigger IT-Ops Teams Webhook · on failure

Every Script Action carries a live dependency graph built from its actual configuration — no manual documentation required.

AI Colleague

A teammate that knows your environment

Most AI tools know nothing about your infrastructure. The PowerGate AI Colleague is different — it connects directly to your PowerGate instance and has real context: your scripts, your execution history, your audit trail, your environment. So when you ask it something, the answer is actually about you.

Investigate problems

"Why did the backup job fail at 2am?" — the AI reads the actual run log, the script content and the error output, then explains the root cause in plain language. No digging through logs yourself.

Draft new automation

"Write a script that checks disk space on all domain controllers and alerts if below 10%." — the AI knows your existing catalog, naming conventions and credential structure, and submits a draft Script Action for admin review. You approve before anything runs.

Query your audit trail

"What ran last night and did anything need attention?" — the AI queries your execution history and gives a plain-English summary. Useful for handovers, Monday morning checks, or answering an auditor without hunting through logs.

MCP

Built on Model Context Protocol (MCP)

MCP is an open standard — developed by Anthropic and now adopted across the industry — that lets AI assistants connect securely to external tools and live data. PowerGate runs as an MCP server, exposing your scripts, runs, audit trail and environment through a governed, permission-aware interface. Your AI assistant talks to PowerGate directly — no copy-pasting logs, no manual context, no hallucinated answers about systems it has never seen.

Governed the same way as everyone else

Its own governed identity

The AI signs in as a dedicated, controlled account — not as an admin, not with elevated rights. You decide exactly what it can see and do.

Same RBAC as everyone else

The AI respects the same role-based access controls as human operators. It only sees scripts and runs that its role permits — nothing more, nothing less.

Drafts for review, never acts alone

When the AI creates or modifies something it submits a draft for a human to approve. It adds insight and speed — not autonomy. Every interaction is fully audited.

Works with Claude (Anthropic) Microsoft Copilot Any MCP-compatible AI assistant Add to your quote
Integrations & API

Fits right into the tools you already run

PowerGate connects to your existing systems — your service desk, monitoring, identity and more — so automation happens where your work already does, not in yet another silo.

Ticketing & ITSM

Run the right action straight from your service desk — ServiceNow, Jira and others — and turn a ticket into a safe, automated fix.

Monitoring & Alerts

Let an alert from your monitoring kick off the right response automatically — fewer wake-ups, faster recovery.

Single Sign-On

Let people sign in with the company accounts they already use — Microsoft Entra ID (OIDC) or Windows / Kerberos single sign-on on the corporate network. Local accounts keep working too, so admins are never locked out.

Notifications

Keep email, chat and your other tools in the loop whenever something runs, needs approval or finishes.

Powerful REST API

Everything PowerGate does is available through a documented API — automate it, query it, or build it into your own apps.

Outbound Webhooks

PowerGate sends webhook notifications to your tools when actions run, need approval or finish. Inbound automation always goes through the authenticated REST API — every request signs in as a user or integration account.

OAuth API Connections

Let your scripts call OAuth-protected APIs — Microsoft Graph, Exchange Online and more — with no secrets in the script. PowerGate mints a fresh access token at run time and injects it securely, so automation can act across your cloud services without ever exposing a credential.

Integration Accounts

Machine-to-machine access for your own apps and systems — issue scoped API tokens so external tools can trigger Script Actions and Logic Flows securely, without a human login or a shared password.

If it happens in PowerGate, you can build on it

A comprehensive REST API exposes the whole platform — trigger automation from HR onboarding, drive PowerGate from your own portal, or wire it into the systems your business already relies on.

Get in touch
How PowerGate compares

Where PowerGate pulls ahead

An honest look at how a purpose-built ZTEG stacks up against the common ways teams run scripts today.

Capability PowerGate Manual scripts & remote access Automation / RMM platforms Per-seat delegation suites
Purpose-built for governed PowerShell execution✓✕~✓
Self-service for staff without sharing admin credentials✓✕~✓
Built-in approvals & complete audit trail✓✕~~
Bundled PowerShell 7 — nothing to install on hosts✓✕✕~
Runs fully air-gapped / offline, no telemetry✓✓✕~
Distributed remote execution, centrally managed✓✕✓~
AI assistant that understands your scripts & runs✓✕✕✕
Open REST API + ITSM / SSO integration✓✕✓~
Simple, predictable licensing (flat core + add-ons)✓—~✕
✓ Yes ~ Partial / varies / add-on ✕ No — Not applicable

This compares common characteristics of each category, not any specific product — individual tools vary. The point isn't that alternatives can't do these things; it's that PowerGate does all of them in one place, with simple, predictable licensing.

Air-gapped & high security

Built for red zones and disconnected networks

PowerGate runs entirely on-premises and needs no connection to the internet — ever. It's a natural fit for air-gapped, classified and security-critical environments where nothing is allowed to phone home.

  • Zero internet dependency — install, license and run fully offline.
  • Self-contained — everything it needs to run is included, nothing downloaded later.
  • Offline licensing — a simple license file, no activation server or phoning home.
  • No telemetry — your scripts, data and audit logs never leave your network.
  • Made for restricted zones — red zones, OT/ICS, classified and regulated networks.
Editions

What's included

One core server with every feature, extended by per-unit add-ons as you grow.

Capability Core Server Remote Engineadd-on AI Assistantadd-on
All execution targets (runspace, process, impersonation)✓——
Logic flows, scheduling & recurrence✓——
RBAC, audit log, approvals & notifications✓——
Credential vault & external credential sources✓——
OAuth API connections (Graph, Exchange & more)✓——
Dynamic parameter scripts (live dropdowns)✓——
Concurrent workers5 included——
Script actions50 included——
Execute on additional remote machines—✓ per engine—
Central management of distributed enginesrequires core✓—
Windows Event Log monitoring & triggers—✓—
File system folder watching & triggers—✓—
Event data injected as script environment variables—✓—
High availability (active/passive clustering, SQL Server)✓ SQL Server required——
AI colleague: ask about scripts & runs, draft new automation——✓ per assistant
Secure sign-in & permission-aware AI accessrequires core—✓

Add-ons are licensed per unit (per remote engine, per AI assistant) and require an active Core Server license.

Pricing

Simple, transparent licensing

One annual core license, plus add-ons exactly where you need them. All prices are per year.

Core platform

Core Server

The complete PowerGate platform with every feature.

€5.490/ year
  • All features included
  • 5 concurrent workers
  • 50 script actions
  • RBAC, audit, scheduling & logic flows
  • Credential vault & impersonation
Request a quote
Add-on

Remote Engine

Execute scripts and sense events on remote machines and sites — managed from one control plane.

€1.490/ year · per engine
  • Remote execution across sites & network zones
  • Centrally managed & monitored
  • Windows Event Log monitoring & triggers
  • File system folder watching & triggers
  • Full event data available in triggered scripts
  • Requires Core Server
Add to quote
Add-on

AI Colleague

An AI teammate that knows your scripts, runs and environment.

€539/ year · per assistant
  • Understands your scripts, executions & setup
  • Looks into problems & explains what went wrong
  • Drafts new automation & submits it for review
  • Secure sign-in, permission-aware & fully audited
  • Requires Core Server

* Requires a separate AI assistant subscription (e.g. Claude or Copilot), billed by that provider.

Add to quote

Add capacity as you grow

Hit the included limits? Expand the core without changing platforms — capacity packs are quoted to fit your scale.

Extra Script Actions

Add exactly the number of script actions you need — sized to your catalogue, not a fixed bundle.

Price on request Request a quote

Additional Concurrent Workers

Add as many worker slots as you need — just like extra Script Actions, choose the number that fits your workload.

Price on request Request a quote

Estimate your annual cost

Core server is always included. Add the engines and AI assistants you need.

Core Serverall features · 5 workers · 50 script actions
€ 5.490
Remote Engines€1.490 / year each
AI Colleagues€539 / year each
Total per year € 2.490

When does it pay for itself?

PowerGate turns expert-only tasks into safe self-service and automation. Estimate the time it gives back to your team.

Hours saved / year —
Net savings / year —
Pays for itself in —

Figures are an indicative estimate based on the values you enter. The PowerGate cost mirrors the configuration above — type your own quote to override it.

Prices are per year, exclusive of applicable VAT. The AI Colleague add-on enables the integration with PowerGate — the AI assistant itself (e.g. Claude or Copilot) is a separate subscription billed by that provider. Multi-year pricing available on request.

FAQ

Frequently asked questions

Everything teams usually ask before rolling out PowerGate.

How is PowerGate deployed, and what are the infrastructure requirements?

PowerGate is self-hosted software that runs on your own Windows infrastructure — on-premises or in your private cloud. It installs as a managed service, stores its data in SQLite or Microsoft SQL Server, and is administered entirely through a web portal. There are no external dependencies, so it sits inside your network and your existing change-control processes.

How does PowerGate enforce least privilege and separation of duties?

Every action is governed by role-based access control, so operators only see and run what their role permits — never raw consoles or shared administrator credentials. Sensitive operations can require approval before they execute, separating the person who requests work from the person who authorises it. Credentials are stored encrypted and used through impersonation, so passwords are never exposed to the people running tasks.

What audit, approval and compliance capabilities does it provide?

PowerGate records a complete trail of every execution, approval and configuration change — who ran what, when, against which target, and the full output. Combined with role-based access and approval workflows, this delivers the evidence and separation-of-duties controls that audited and regulated environments expect.

Can PowerGate operate in air-gapped or data-sovereign environments?

Yes. PowerGate requires no internet connection at any point — installation, licensing and operation are fully offline, there is no telemetry or call-home, and your scripts, data and logs never leave your network. That makes it suitable for air-gapped, classified, OT/ICS and data-sovereignty-constrained deployments.

How does it integrate with our ITSM, identity and monitoring tools?

PowerGate exposes a comprehensive REST API, so it fits into your existing toolchain rather than replacing it. You can trigger actions from your service desk or ITSM (such as ServiceNow or Jira), let monitoring alerts start automated responses, sign users in through Microsoft Entra ID and single sign-on, and push notifications to email and chat. Inbound requests are never anonymous: every call authenticates as a user or a dedicated integration account, and PowerGate sends outbound webhooks to notify your tools when work happens.

How is the AI Colleague governed so it stays secure?

The optional AI Colleague operates within exactly the same permission model as everyone else: it signs in as its own governed identity, can only see and do what its role allows, drafts changes for human review rather than acting unilaterally, and every interaction is fully audited. It adds insight and speed without widening your attack surface.

How is PowerGate licensed, and how do we expand over time?

PowerGate is licensed annually. One Core Server license (€5,490/year) includes the full platform with 5 concurrent workers and 50 script actions. You then expand precisely where needed — additional remote engines (€1,490/year each), AI Colleague seats (€539/year each), and capacity packs for more workers or script actions (on request) — without migrating or re-platforming. Add-ons require an active Core Server license. Note that the AI Colleague add-on covers the PowerGate integration only — the AI assistant itself (such as Claude or Copilot) is a separate subscription billed by that provider.

The story behind PowerGate

Built by a sysadmin, for sysadmins

PowerGate started the same way most tools in this space do — with a daily frustration that nobody had quite solved. The developer behind it was working as a systems administrator, running the same PowerShell scripts day after day: resetting passwords, unlocking accounts, provisioning users, checking disk space. Not complex work — but work that required admin access, a console, and the right knowledge to do safely.

The options were to hand those scripts to helpdesk along with admin credentials, or to spend half the day fielding requests that should have been self-service. The available tools were either too heavy for a small team, too cloud-dependent for the environments in play, or simply not built with PowerShell as a first-class citizen.

So PowerGate was built — not to compete with Rundeck or ServiceNow, and not to become the next big enterprise platform. Just to solve the problem that was there every day: give the right people safe, audited access to the scripts that matter, without opening consoles or sharing passwords.

PowerGate is still exactly that. One person wrote it, knows every line of it, and answers every support email. That is not a weakness — it means the tool stays honest. It does what it says, it does not phone home, and it will not be acquired and turned into something unrecognisable. It exists because the problem is real, and the solution deserves to be done properly.

For the practical question every IT manager rightly asks: PowerGate stores everything in a standard SQL database you own outright. Your scripts, audit logs and configuration are plain files and plain data — never locked to a vendor, never held in a cloud account. If the developer disappeared tomorrow, your installation keeps running and your data stays yours.

— The PowerGate developer

Getting started

From first contact to up and running

PowerGate is self-hosted and licensed per installation. Onboarding is a short, guided process — you're never left to figure it out alone.

1

Request

Get in touch and let us know you'd like to evaluate PowerGate.

2

See a demo

A guided walkthrough of the platform tailored to your use case.

3

Scope your environment

Map your targets, networks, security needs and which add-ons fit your setup.

4

Guided installation

Install the Core Server — and any remote engines — on your own infrastructure, with direct support throughout.

5

Get your license

Share the location key generated during installation and your license is issued, including any add-ons.

6

You're live

PowerGate is up and running — fully governed, audited and ready for your team.

No public binaries to hunt down — the installation package is provided directly, signed and verifiable, as part of onboarding.

Ready to put PowerGate to work?

Describe your environment and get a tailored quote — core plus exactly the add-ons you need.

Request a quote Book a demo