Guided setup
Onboarding creates a provider credential, route, policy baseline, and one-time workload key without requiring application teams to understand the storage model.
For system administrators
Put AI keys, routes, budgets, and audit evidence in one admin console.
Give each application one revocable gateway key while encrypted provider credentials, health-aware routes, policy, budget stops, billing, and signed audit delivery remain centrally administered.
One workload key instead of provider secrets in every application
Health-aware fallback with explicit cost and capability boundaries
Self-service OIDC or SAML, SCIM, and signed HTTPS audit delivery
In plain language
Administer AI access with the same concepts used for any shared enterprise service.
Providers are upstream connections, routes are service pools, workload keys are application identities, policies are controls, and budgets are quotas with financial meaning. The console presents those objects directly and includes an owner guide so an administrator does not need to understand the storage layer.
The operational outcomeA new workload can be onboarded, limited, diagnosed, and revoked from one console instead of several vendor portals.
For the operating team
A repeatable setup path for every workload.
Onboarding links each step to the console object it creates and the evidence used to troubleshoot it later.
What administrators configure
Connect supply
Add a write-only provider credential, name its owner and environment, then place it in a compatible route.
Issue access
Create a one-time workload key with the correct route, policy, rate, concurrency, and budget scope.
Operate and support
Use reason-coded evidence to distinguish identity, policy, guardrail, billing, gateway, and provider failures.
What happens to each request
- 01Authenticate
Resolve the tenant, workload key, user context, and client mode before considering a provider.
- 02Constrain
Remove targets that violate model, capability, budget, risk, or environment policy.
- 03Select
Rank eligible credentials and models by the configured priority, weight, health, or estimated request cost.
- 04Reconcile
Serve a governed exact-cache hit or call the selected provider, then record the decision and reconcile reserved budget.
See the working control
One place to see whether the control is actually in place for system administration.
For system administration, live API-backed counts for provider connections, routes, policies, requests, latency, and payload-storage posture.
- This system administration view runs in the working customer console
- Exercised with safe OpenAI- and Anthropic-compatible simulators
- The system administration capture excludes keys, prompt text, responses, and private email
For system administration, live API-backed counts for provider connections, routes, policies, requests, latency, and payload-storage posture.
What administrators can change
The settings behind for system administrators.
For system administrators, the console shows each setting, its owner, and its scope so administrators can review changes before they reach live traffic.
Fit existing identity
Owners configure standards-compatible OIDC or SAML 2.0, exact directory-group rules, and digest-only SCIM 2.0 provisioning credentials. Signed HTTPS audit delivery sends reason-coded events to an approved receiver.
Diagnose from evidence
Request metadata separates policy, guardrail, and billing denials from gateway and upstream outcomes, then connects the route, model, fallback, latency, and spend evidence without retaining payload bodies.
Evidence, not assertions
Start troubleshooting from the request reason code.
The console is designed to narrow an incident to the responsible boundary before an administrator opens a provider ticket or changes policy.
Review security boundaries and current status Read the plain-language AI gateway guide Use the 12-test enterprise evaluation- Connect supply: Add a write-only provider credential, name its owner and environment, then place it in a compatible route.
- Issue access: Create a one-time workload key with the correct route, policy, rate, concurrency, and budget scope.
- Operate and support: Use reason-coded evidence to distinguish identity, policy, guardrail, billing, gateway, and provider failures.
Questions teams ask
Questions about for system administrators.
What buyers, administrators, and security reviewers need to confirm for for system administrators.
Where do I start after signing in?
Open Owner guide or Onboarding in the customer console. The sequence is provider credential, route, policy baseline, workload key, client configuration, then an Observe-mode test.
Can I retrieve a workload key later?
No. Workload keys are displayed once. Store the value in the application's secret manager; rotate it from the console if it is lost or exposed.
What identity systems work today?
The console provisions standards-compatible OIDC and SAML 2.0 connections through Amazon Cognito. Owners map exact directory groups to built-in roles or selected-policy grants; unmapped users are always read-only. SAML signing certificates receive lifecycle and scheduled expiry/rollover checks, with fail-closed login when recorded trust ends. Each connection can also provision and deactivate users and groups through bounded SCIM 2.0, with optional active-user enforcement at federated login. Expiring cross-workspace invitations can use customer-named resource-scoped roles. Live Entra/Okta conformance evidence is not currently included.
Start safely
Start guided setupSee what the policy would do before it can block production.
Start with a provider connection, a limited workload key, and Observe mode; move to enforcement after your team confirms the result.