> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Control access to private APIs, databases, and caches.

A Resource is a private API, database, or cache that Forge can identify,
authenticate to, and protect with protocol-aware policy. People, agents, and
services use their Forge identity; the destination credential stays at the
customer-deployed Resource gateway.

Resources have their own policy family. Existing Access Policies continue to
control AI products, applications, processes, domains, and routes. Existing
Content Policies continue to control prompts, model responses, tools, and MCP
activity. Resource Policies control Resource connections, requests, commands,
and supported data transformations.

## Supported protocols

| Protocol | Policy depth |
| - | - |
| HTTP/HTTPS | Connection and request decisions; bounded JSON request redaction and response redaction or filtering |
| PostgreSQL | Connection and command decisions; result-column redaction and row filtering |
| MySQL | Connection and command decisions; result-column redaction and row filtering |
| Redis | Connection and command decisions |

See [Protocols](/resources/protocols/overview) for client behavior and explicit
limits.

## Two access paths

Both paths use the same Resource definition, identity resolution, destination
credential, Resource Policies, approval grants, and activity records.

| Path | Client experience | Best for |
| - | - | - |
| Automatic routing | Keep the destination hostname and ordinary client command | People and local agents on managed devices |
| Direct access | Connect to a Resource gateway with a short-lived Forge credential | Services, agents, unmanaged devices, and explicit clients |

Automatic routing changes the network path before a connection opens. Forge
cannot govern one SQL command on a database connection that otherwise bypasses
Forge; the entire connection must first use one of these paths.

## How the pieces fit

1. A **Resource** defines the protocol and destination.
2. A **Resource gateway** runs in a customer network that can reach it.
3. A **credential assignment** determines how Forge authenticates upstream for
   the caller.
4. A **Resource Policy** evaluates the connection and each supported operation.
5. **Live → Resources** records safe evidence and policy outcomes.
6. **Responses** handles approval requests, decisions, and short-lived grants.

Forge's control plane distributes encrypted configuration, coordinates
approvals, and receives bounded health and activity events. Request and
response bodies, raw SQL, database result values, and destination secrets do
not transit the control plane during normal Resource traffic.

Start with the [Resource quickstart](/resources/quickstart), or continue to
[Configure Resources and routing](/resources/configure-resources-and-routing).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.