Add Agent Network section

src/components/NavigationDocs.jsx

@@ -76,6 +76,45 @@ export const docsNavigation = [
       { title: 'CLI', href: '/get-started/cli' },
     ],
   },
+  {
+    title: 'AGENT NETWORK',
+    links: [
+      { title: 'Overview', href: '/agent-network' },
+      { title: 'Quickstart', href: '/agent-network/quickstart' },
+      { title: 'Providers', href: '/agent-network/providers' },
+      {
+        title: 'Policies',
+        href: '/agent-network/policies',
+        links: [
+          {
+            title: 'Token & Budget Limits',
+            href: '/agent-network/policies/limits',
+          },
+          { title: 'Guardrails', href: '/agent-network/policies/guardrails' },
+        ],
+      },
+      { title: 'Global Limits', href: '/agent-network/global-limits' },
+      {
+        title: 'Usage & Logs',
+        href: '/agent-network/usage-and-logs',
+        links: [
+          {
+            title: 'Usage Overview',
+            href: '/agent-network/usage-and-logs/usage-overview',
+          },
+          {
+            title: 'Access Logs',
+            href: '/agent-network/usage-and-logs/access-logs',
+          },
+          {
+            title: 'Log Collection & Retention',
+            href: '/agent-network/usage-and-logs/log-collection',
+          },
+        ],
+      },
+      { title: 'Self-Hosting', href: '/agent-network/self-hosting' },
+    ],
+  },
   {
     title: 'MANAGE NETBIRD',
     links: [

src/pages/agent-network/index.mdx

@@ -0,0 +1,74 @@
+import { Note } from '@/components/mdx'
+
+export const description =
+  'Agent Network is NetBird\'s control layer for AI agents — a keyless gateway to LLM APIs and scoped, identity-based access to your internal resources, all over the tunnel with per-identity policies, limits, and audit.'
+
+# NetBird Agent Network
+
+Agent Network is NetBird's control layer for AI agents. It gives every agent a
+real network identity and governs what it can reach:
+LLM APIs and AI gateways it can call, and the internal resources it can access. Traffic
+flows only over the NetBird tunnel, scoped by policy, with no API keys or other credentials
+to leak.
+
+<p>
+    <img src="/docs-static/img/agent-network/overview/agent-network-control-center-v2.png" alt="agent network" className="imagewrapper-big" />
+</p>
+
+<Note>
+  Agent Network is currently in Beta. It is open source and can be self-hosted on your own infrastructure.
+    See the [GitHub repo](https://github.com/netbirdio/netbird/agent-network) for more details.
+</Note>
+
+## Two Use Cases
+
+Agent Network is built on NetBird’s overlay network and reverse-proxy capabilities, giving any AI agent secure access
+to LLM APIs and private resources. It works with human-in-the-loop tools like Claude Code and Codex, as well as fully autonomous
+workloads running on VMs, Mac minis, or other infrastructure. Below are two specific use cases.
+
+### Keyless Gateway to LLM APIs for Cost Control and Auditing
+
+Your agents reach OpenAI, Anthropic, and AI gateways through a single
+endpoint that's only reachable over the end-to-end encrypted tunnel. There is no need to
+store or share API keys or other credentials. NetBird holds the provider API
+key server-side, so it never reaches the caller, and every request is tied to a
+real identity from your identity provider like Okta, Microsoft Entra ID, Google,
+and others. That lets you apply per-identity policies, token and cost limits, model guardrails, and
+full audit logs to outbound LLM traffic.
+
+<p>
+    <img src="/docs-static/img/agent-network/overview/agent-network-llm-policy.png" alt="agent network llm policy" className="imagewrapper" />
+</p>
+
+### Agentic Access to Internal Resources and Local Models
+
+Similarly, agents can securely reach internal resources such as databases, APIs, and private services that are not
+exposed to the internet. This also covers private models served by Ollama, vLLM, or GPU clusters, giving agents secure
+access over the same tunnel without public exposure.
+
+NetBird’s overlay network traverses firewalls and works across datacenters and cloud environments without opening ports,
+configuring security groups, or changing network topology. Each agent connects with its own identity, and access policies
+define exactly which resources it can reach, just like any other NetBird peer in the network.
+
+<p>
+    <img src="/docs-static/img/agent-network/overview/agent-network-internal-resources-policy.png" alt="agent network llm policy" className="imagewrapper" />
+</p>
+
+## How NetBird Fits in Your Enterprise IT Stack
+
+It’s common for organizations to rely on a centralized identity provider like Okta, Microsoft Entra ID, Google, or others.
+It’s also common for IT teams to manage access to internal resources while keeping costs under control.
+
+Traditionally, IT has done this through the internal network, using VPNs to give employees access to databases, web servers,
+internal APIs, and other private services.
+
+AI agents should be treated the same way: as another trusted entity on the network. They need secure access to
+internal resources, and modern enterprise resources now include LLMs and API endpoints alongside traditional infrastructure.
+That makes agent access a natural responsibility for IT.
+
+Because NetBird connects seamlessly with existing identity providers, IT teams can integrate NetBird Agent Network into
+their enterprise stack with minimal changes.
+
+## Next steps
+
+- [Quickstart](/agent-network/quickstart). Deploy NetBird Agent Network and make your first routed LLM call.

src/pages/agent-network/policies/index.mdx

@@ -0,0 +1,55 @@
+export const description =
+  'Policies connect users and agents to AI providers, with optional token and budget limits plus guardrails for LLM access.'
+
+# Policies
+
+Policies connect users and agents (source groups) to AI providers — controlling
+which identities can reach which providers and models, with optional limits and
+guardrails.
+
+<p>
+    <img src="/docs-static/img/agent-network/policies/agent-network-create-policy.png" alt="agent network llm policy" className="imagewrapper" />
+</p>
+
+## How Policies Work
+
+- **Source groups** — the users/agents the policy applies to.
+- **Destination providers** — the providers the policy grants access to.
+- **Limits** — optional per-user and per-group token and budget caps.
+- **Guardrails** — optional model allowlist and prompt capture.
+
+A request is allowed when a policy connects the caller's groups to the resolved
+provider and no applicable limit is exhausted.
+
+## Create a Policy
+
+1. Go to **Agent Network → Policies** and add a policy.
+2. Choose the source groups and destination providers.
+3. Optionally attach [limits](/agent-network/policies/limits) and
+   [guardrails](/agent-network/policies/guardrails).
+
+Try it out by calling your Agent Network endpoint. The access log will show the
+policy in action:
+
+```bash
+curl -vk https://sailcloth.netbird.ai/v1/chat/completions \
+  --header "Content-Type: application/json" \
+  --data '{
+    "model": "gpt-5.5",
+    "messages": [
+      {
+        "role": "user",
+        "content": "What is NetBird?"
+      }
+    ]
+  }' | jq
+```
+
+<p>
+    <img src="/docs-static/img/agent-network/policies/agent-network-access-log.png" alt="agent network log" className="imagewrapper-big" />
+</p>
+
+## More
+
+- [Token & Budget Limits](/agent-network/policies/limits)
+- [Guardrails](/agent-network/policies/guardrails)

src/pages/agent-network/policies/limits.mdx

@@ -0,0 +1,26 @@
+export const description =
+  'Cap LLM token usage and spend per user or per group within a policy, over a rolling window.'
+
+# Token & Budget Limits
+
+Limits cap how much a policy's callers can consume. They come in two halves,
+each enforceable per user and per group over a rolling window.
+
+## Token limits
+
+- **User cap** — maximum tokens per user in the window.
+- **Group cap** — maximum tokens per group in the window.
+- **Window** — the rolling period the cap applies to.
+
+## Budget limits
+
+- **User cap (USD)** — maximum spend per user in the window.
+- **Group cap (USD)** — maximum spend per group in the window.
+- **Window** — the rolling period the cap applies to.
+
+## How enforcement works
+
+Before each request, NetBird checks the applicable caps; when a cap is
+exhausted, the request is denied with a reason surfaced in the
+[access logs](/agent-network/usage-and-logs/access-logs). For account-wide caps
+that apply across all policies, see [Global Limits](/agent-network/global-limits).

src/pages/agent-network/quickstart.mdx

@@ -0,0 +1,42 @@
+import { Note } from '@/components/mdx'
+
+export const description =
+  'Get an LLM request routed through NetBird Agent Network end to end: connect a provider, create a policy, and make your first keyless call.'
+
+# Quickstart
+
+This guide takes you from zero to a working, keyless LLM call through Agent
+Network in a few minutes.
+
+<Note>
+  You'll need an account with Agent Network enabled and at least one connected
+  peer (your agent or workstation) on the tunnel.
+</Note>
+
+## 1. Connect a provider
+
+Add an AI provider (for example OpenAI) and paste its API key. NetBird stores
+the key and exposes a tunnel-only endpoint in return. See
+[Providers](/agent-network/providers).
+
+## 2. Create a policy
+
+Create a policy that connects a source group (your users or agents) to the
+provider. See [Policies](/agent-network/policies).
+
+## 3. Make a request
+
+Point your LLM client at the Agent Network endpoint instead of the provider's
+URL — no API key required from the client.
+
+```bash
+# TODO: replace with the real endpoint + example request
+curl https://<your-endpoint>/v1/chat/completions \
+  -H "Content-Type: application/json" \
+  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}'
+```
+
+## 4. See it in Usage & Logs
+
+Open [Usage & Logs](/agent-network/usage-and-logs) to confirm the request was
+recorded, with the caller identity, model, tokens, and cost.