Based on the available documentation, the consent screen operates through the Consent Service hosted at each gateway subdomain (e.g.,

acme-brave-coral-37.agent.security

) (1) . The Consent Service serves as the OAuth 2.1 Authorization Server for the gateway . The documentation describes three deployment models (2) : • *Hosted (SaaS) * — managed by Permit at

*.agent.security

, available on all plans • ​*Customer-Controlled*​ — gateway and PDP run in your environment (VPC, on-prem) , with MCP traffic staying within your network while Permit.io remains the control plane • ​*Fully On-Premises*​ — the entire stack, including the control plane, runs in your environment and supports air-gapped environments with no internet connectivity Customer-controlled and fully on-premises deployments are available on Enterprise plans . However, the documentation doesn't explicitly address white-labeling, custom domains for the consent screen, or UI theming capabilities. The consent flow is described as being served by the Consent Service at the gateway subdomain (1) , but customization options aren't detailed. I'd recommend reaching out over Email to discuss your specific white-labeling requirements, especially regarding custom domains and UI customization for the consent screen. Since customer-controlled and on-premises deployments are available on Enterprise plans, there may be flexibility here that isn't fully documented in the public materials. Would you like a general answer based on my knowledge instead?

To learn more, see the sources I considered: [[1] Consent Service](https://docs.permit.io/permit-mcp-gateway/consent-service) [[2] Permit MCP Gateway Overview](https://docs.permit.io/permit-mcp-gateway/overview)