Guided setup
Onboarding creates a provider credential, route, policy baseline, and one-time workload key without requiring application teams to understand the storage model.
For system administrators
Put AI keys, routes, budgets, and audit evidence in one admin console.
Give each application one revocable gateway key while encrypted provider credentials, health-aware routes, policy, budget stops, billing, and signed audit delivery remain centrally administered.
One workload key instead of provider secrets in every application
Health-aware fallback with explicit cost and capability boundaries
Self-service OIDC or SAML, SCIM, and signed HTTPS audit delivery
In plain language
Administer AI access with the same concepts used for any shared enterprise service.
Providers are upstream connections, routes are service pools, workload keys are application identities, policies are controls, and budgets are quotas with financial meaning. The console presents those objects directly and includes an owner guide so an administrator does not need to understand the storage layer.
The operational outcomeA new workload can be onboarded, limited, diagnosed, and revoked from one console instead of several vendor portals.
For the operating team
A repeatable setup path for every workload.
Onboarding links each step to the console object it creates and the evidence used to troubleshoot it later.
What administrators configure
Connect supply
Add a write-only provider credential, name its owner and environment, then place it in a compatible route.
Issue access
Create a one-time workload key with the correct route, policy, rate, concurrency, and budget scope.
Operate and support
Use reason-coded evidence to distinguish identity, policy, guardrail, billing, gateway, and provider failures.
What happens to each request
- 01Authenticate
Resolve the tenant, workload key, user context, and client mode before considering a provider.
- 02Constrain
Remove targets that violate model, capability, budget, risk, or environment policy.
- 03Select
Rank eligible credentials and models by the configured priority, weight, health, or estimated request cost.
- 04Reconcile
Serve a governed exact-cache hit or call the selected provider, then record the decision and reconcile reserved budget.
See the working control
One place to see whether the control is actually in place.
Live API-backed counts for provider connections, routes, policies, requests, latency, and payload-storage posture.
- Rendered by the real customer console and control API
- Exercised with safe OpenAI- and Anthropic-compatible simulators
- Sanitization gate rejects credential-shaped values and private owner email
Live API-backed counts for provider connections, routes, policies, requests, latency, and payload-storage posture.
Control surface
Useful on day one. Explainable on day one hundred.
Each control has an operating path, an owner, and evidence that can be reviewed without collecting prompt bodies by default.
Fit existing identity
Owners configure standards-compatible OIDC or SAML 2.0, exact directory-group rules, and digest-only SCIM 2.0 provisioning credentials. Signed HTTPS audit delivery sends reason-coded events to an approved receiver.
Diagnose from evidence
Request metadata separates policy, guardrail, and billing denials from gateway and upstream outcomes, then connects the route, model, fallback, latency, and spend evidence without retaining payload bodies.
Evidence, not assertions
Start troubleshooting from the request reason code.
The console is designed to narrow an incident to the responsible boundary before an administrator opens a provider ticket or changes policy.
Review security boundaries and current status Read the plain-language AI gateway guide Use the 12-test enterprise evaluation- Reason-coded policy, route, retry, fallback, and denial metadata
- Bounded tool names, types, MCP hosts, and authorization outcomes—without schemas, arguments, or results
- Provider-reported usage reconciliation for complete responses and supported terminal streams
- Tenant-bound credential encryption and fail-closed tenant authorization
- Signed, retryable administrative audit delivery with payloads and configuration snapshots excluded
- Clear labels separating available controls from items that still require validation
Questions teams ask
Know the boundary before you deploy.
Clear answers for buyers, administrators, and security reviewers.
Where do I start after signing in?
Open Owner guide or Onboarding in the customer console. The sequence is provider credential, route, policy baseline, workload key, client configuration, then an Observe-mode test.
Can I retrieve a workload key later?
No. Workload keys are displayed once. Store the value in the application's secret manager; rotate it from the console if it is lost or exposed.
What identity systems work today?
The console provisions standards-compatible OIDC and SAML 2.0 connections through Amazon Cognito. Owners map exact directory group values to seven built-in roles; unmapped users are always read-only. SAML signing certificates receive lifecycle and scheduled expiry/rollover checks, with fail-closed login when recorded trust ends. Each connection can also provision and deactivate users and groups through bounded SCIM 2.0, with optional active-user enforcement at federated login. Custom roles and live Entra/Okta conformance evidence are not currently included.
Start safely
Start guided setupSee what the policy would do before it can block production.
Connect a provider credential, create a workload key, and begin in Observe mode. Move a tested rule to Enforce when your team is ready.