AI Gateway overview
What an AI gateway is, and how model calls reach providers through /gateway/llm.
If you don't see this feature in your console, ask your SecureAuth contact to
enable the llm_gateway feature flag for your organization.
When agents call models straight from each provider, each with its own keys, nothing decides which models they use or records the calls they make. An AI gateway, also called an LLM gateway, sits between your agents and the model providers, so every model call passes through one place you control.
What is an AI gateway?
In Agent Authority, agents send model calls to the gateway at /gateway/llm, not to the provider.
The gateway accepts calls in the OpenAI and Anthropic API formats.
MCP tool calls go through the MCP Gateway instead.
What happens to a model call
The gateway first finds a Model Providers connection that serves the requested model. If none does, it refuses the call. It then checks your model access rules, and a call that no rule allows is denied. An allowed call goes to the provider with the connection's API key, or with the user's own sign-in on a sign-in connection. The gateway records each call from a signed-in agent, including denied calls and streams cut off partway.
Next steps
You can now follow a model call from the agent, through the rules, to the provider. Write your first rule in Model access rules.