A secure enterprise AI gateway for centralized provider credentials, SSO, scoped workload keys, tenant-bound encryption, guardrails, and audit evidence.
Applications receive revocable workload keys rather than raw provider secrets. The gateway resolves tenant and policy context first, selects an eligible credential, and decrypts that credential only for the provider call. Operational telemetry is metadata-minimized by default.
Customer administrators and AI Gateway HQ staff use isolated identity tenants and explicit access boundaries.
Issue scoped virtual keys and bind policy, rate, budget, and environment controls to each one.
Write encrypted credentials with tenant and credential encryption context; never return the secret value.
Use OIDC, built-in roles, mandatory customer/staff MFA, and time-bounded support authorization.
Authorize bounded tool and MCP metadata at the model boundary without turning the gateway into an untrusted-code executor or retaining tool arguments and results.
Bind the request to an organization, workload, environment, user, and declared execution context.
Apply policy and local attack signals before any provider credential is decrypted.
Allow, deny, cap, reroute, or observe the request with a stable reason code.
Write authorized metadata for review without persisting prompt or response bodies by default.
For security review, the console identifies each upstream account and its health while provider secrets remain write-only.
For security review, the console identifies each upstream account and its health while provider secrets remain write-only.
For security by construction, the console shows each setting, its owner, and its scope so administrators can review changes before they reach live traffic.
The hosted ledger retains operating metadata, policy reasons, bounded tool names, tool types, MCP hosts, counts, cost, and timing. Prompt and response content, tool schemas, arguments, and results are not retained by default.
An owner can add OIDC or public SAML metadata, verify the Cognito provider, map exact external groups to built-in or selected-policy roles, and issue a connection-bound SCIM 2.0 credential without a support ticket. SAML metadata and signing keys are checked during lifecycle changes and on a bounded schedule; the console exposes hash-only fingerprints, key count, last attempt, and the exact fail-closed trust expiry. Provisioning can be paused independently from active-user login enforcement; SCIM groups cannot grant gateway roles. Separate expiring workspace delegation supports customer-named roles with independently selected policy read, change, approval, identity, security, and billing authority.
Production changes require infrastructure review, code and dependency scans, active web security tests, software inventories, and signed release artifacts. Restore drills run in isolated environments. Their results are engineering evidence, not a contractual recovery time or SLA. Independent penetration testing and formal assurance remain separate work.
Current controls provide identity, tenant, policy, cost, timing, and outcome metadata. Formal certification and customer-specific validation remain separate work.
Review security boundaries and current status Use the CISO security checklist Read the plain-language AI gateway guide Review live-request governance Use the 12-test enterprise evaluationWhat buyers, administrators, and security reviewers need to confirm for security by construction.
The console treats provider credentials as write-only. Runtime decryption is tenant-bound. Staff access must be separately authorized, although external penetration testing is still required before high-risk production use.
Yes. Organization owners configure tenant-pinned OIDC or SAML 2.0 sign-in, exact external-group role rules, and connection-bound SCIM 2.0 user and group lifecycle from the console. SAML metadata and signing keys are checked during setup and on a schedule; only hash-and-expiry evidence is retained, overlapping rollover keys extend trust safely, and expired trust blocks login. SCIM login enforcement can require an active provisioned identity without allowing SCIM groups to grant roles. Owners can separately scope portfolio administrators and analysts, and can issue expiring custom delegated roles that independently grant selected-policy read, change, or approval plus workspace identity, security, or billing administration. Live third-party conformance evidence is not currently included.
No certification is claimed. The architecture and evidence model are being built toward later assurance work, but certification and regulated-use validation are still required.
Start with a provider connection, a limited workload key, and Observe mode; move to enforcement after your team confirms the result.