Adopt without another platform migration
Use AI Gateway HQ as the endpoint or layer governance over provider and gateway investments already in place.
For CIOs
Turn scattered AI consumption into an accountable service.
Give teams fast access while standardizing purchasing visibility, ownership, and operating controls.
A single inventory of models, providers, accounts, and owners
Executive spend and adoption reporting
A documented evaluation path for customer-controlled deployment, which is not generally available today
In plain language
Create one accountable AI service without forcing one model on every team.
The gateway gives the organization one place to see who is using which provider, under whose budget, with which policy and route. Teams keep access to suitable models while leadership gains an operating boundary that can evolve with purchasing and risk decisions.
The executive outcomeFaster adoption, fewer unowned provider accounts, and a credible path from experimentation to governed service delivery.
For the operating team
Delegate daily operation while keeping the boundary visible.
The current console separates providers, routes, workloads, policies, budgets, billing, evidence, and support.
What administrators configure
Inventory
Name the provider accounts, models, workloads, owners, and environments that are allowed to participate.
Operating policy
Connect acceptable use, budget, risk, and continuity rules to enforceable request decisions.
Rollout
Pilot in Observe mode, publish supported client setup, and expand only after evidence review.
What happens to each request
- 01Identify
Bind the request to an organization, workload, environment, user, and declared execution context.
- 02Evaluate
Apply policy and local attack signals before any provider credential is decrypted.
- 03Act
Allow, deny, cap, reroute, or observe the request with a stable reason code.
- 04Evidence
Write authorized metadata for review without persisting prompt or response bodies by default.
See the working control
One place to see whether the control is actually in place.
Live API-backed counts for provider connections, routes, policies, requests, latency, and payload-storage posture.
- Rendered by the real customer console and control API
- Exercised with safe OpenAI- and Anthropic-compatible simulators
- Sanitization gate rejects credential-shaped values and private owner email
Live API-backed counts for provider connections, routes, policies, requests, latency, and payload-storage posture.
Control surface
Useful on day one. Explainable on day one hundred.
Each control has an operating path, an owner, and evidence that can be reviewed without collecting prompt bodies by default.
Make ownership visible
Every request is attributed to an organization scope, workload, user, and policy decision.
Buy governance, not tokens
BYOK pricing keeps provider negotiations and discounts in your control.
Evidence, not assertions
Answer ownership, spend, and control questions from one trail.
Executive reporting should be derived from request and configuration evidence rather than manual provider screenshots.
Review security boundaries and current status- Reason-coded policy, route, retry, fallback, and denial metadata
- Bounded tool names, types, MCP hosts, and authorization outcomes—without schemas, arguments, or results
- Provider-reported usage reconciliation for complete responses and supported terminal streams
- Tenant-bound credential encryption and fail-closed tenant authorization
- Signed, retryable administrative audit delivery with payloads and configuration snapshots excluded
- Clear labels separating available controls from items that still require validation
Questions teams ask
Know the boundary before you deploy.
Clear answers for buyers, administrators, and security reviewers.
Does adopting a gateway require a model standardization decision?
No. A route can include several provider accounts and models while policy determines the eligible set for each workload.
Can we start with our existing provider contracts?
Yes. BYOK keeps provider purchasing and negotiated pricing under the customer's accounts while centralizing the runtime control path.
Is dedicated deployment available now?
The current service is a hosted AWS production cell. Customer-VPC, dedicated, and private deployment packaging are contract design paths, not a generally available self-service feature.
Start safely
Start guided setupSee what the policy would do before it can block production.
Connect a provider credential, create a workload key, and begin in Observe mode. Move a tested rule to Enforce when your team is ready.