Model Ops

One governed model layer for every provider.

Route every agent run across Anthropic, Gemini, OpenAI, Mistral, Groq, xAI and Cohere — or your own local models — through one policy-and-quota broker. Pick the model by capability and cost, pin it by residency, and never let an agent reach a model it isn't allowed to use.

Book a demoRead the docs

Live adapters: Anthropic · Gemini · keys AES-256-GCM encrypted at rest

Model Ops
Routerpolicy + quotaAnthropicquota 90%Geminiquota 79%OpenAIquota 68%Mistralquota 57%Groqquota 46%vLLM (local)byo · residency
model-ops ▸ multi-provider routing · quotas · BYO-model
The problem

Hard-coding one model is a single point of failure.

When provider keys live in scattered .env files and model choice is baked into each agent, you can't switch providers when one degrades, can't enforce a residency boundary, and can't stop an agent from calling a model your policy forbids. Model Ops makes the model a governed, swappable setting — keys encrypted at rest, never returned, and every route enforced by the same gate that runs the rest of the platform.

How it works

A router that decides which model — and whether it's even allowed.

Each run resolves to a model through one broker: policy and the agent's identity allow-list decide which providers are eligible, quotas and live spend decide capacity, and capability and cost decide the pick. Set a provider key once in Settings · AI Providers and matching agents flip from deterministic mock to live model calls immediately — no redeploy.

  • Agent IAM allow-lists enforce the model set — off-list resolves to 403 MODEL_NOT_ALLOWED
  • Keys are AES-256-GCM encrypted at rest and never returned — the UI shows only ••••<last4>
  • Execution mode is governed: auto goes live when a key is present, live requires one, mock forces deterministic
  • Swap or disable a provider centrally — every matching agent reroutes without a code change
See Agent IAM
Model Ops
Routerpolicy + quotaAnthropicquota 90%Geminiquota 79%OpenAIquota 68%Mistralquota 57%Groqquota 46%vLLM (local)byo · residency
model-ops ▸ multi-provider routing · quotas · BYO-model
What Model Ops governs

Routing, quotas, endpoints, and your own models — under one broker.

The full model layer: which providers are reachable, how much each agent and tenant may spend on them, where requests are allowed to run, and how to bring your own local models into the same governed runtime.

Multi-provider routing
  • Anthropic (Claude) · live adapter
  • Google Gemini · live adapter
  • OpenAI · stored, adapter pending (shown honestly)
  • Mistral · Groq · xAI · Cohere
  • Route by capability, cost, or fallback
Quotas & compute broker
  • Per-agent and per-tenant model quotas
  • Live spend feeds cost governance caps
  • Capacity-aware routing under quota pressure
  • Capability/cost-based model selection
Credentials & endpoints
  • Set keys in Settings · AI Providers — no .env edit
  • AES-256-GCM encrypted at rest, never returned
  • Status: not set · configured · disabled · live
  • Per-provider enable / disable / rotate
BYO local models
  • vLLM · Ollama · TGI endpoints
  • Self-hosted models in the same broker
  • Air-gapped and VPC deployment
  • Residency pinning per provider / region
From key to governed run

Configure once. Every matching agent reroutes.

  1. 01

    Register providers

    Add hosted keys (Anthropic, Gemini, …) or point the broker at a local vLLM / Ollama / TGI endpoint. Keys are encrypted at rest and masked everywhere.

  2. 02

    Set allow-lists & quotas

    Agent IAM pins each agent's allowed models; quotas and 30-day budgets cap spend. Residency rules pin where requests are allowed to run.

  3. 03

    Route & enforce

    The broker picks an eligible model by capability and cost. Off-list calls fail 403; runs over cap fail 402. Every choice lands in the trust ledger.

Prove it — don't just claim it

Every route is enforced and recorded.

The broker returns the same fail-closed verdicts as the rest of the runtime — and every resolution is auditable.

model-ops ▸ route resolutions
Fraud Triageclaude-opus · routed · $0.018200 routed
KYC Screenerrequested gpt-4o · off allow-list403 MODEL_NOT_ALLOWED
Bulk Summarizer30-day cap reached · $10,000402 BUDGET_EXCEEDED
Local ReviewervLLM · eu-central · residency ok200 routed
Doc ExtractorOpenAI key stored · no adapterno adapter yet
trust-ledger ▸ every model resolution recorded with provider, cost & verdict
Works with the rest of the runtime

Model Ops is one gate in the chain.

The model layer plugs into the same identity, budget, and audit machinery that governs every run.

Security & compliance

A model layer your security review can sign off.

Encrypted credentials, fail-closed routing, residency pinning, and BYO local models for air-gapped deployments — mapped to the frameworks your auditors already use.

SOC 2ISO 27001ISO 42001GDPREU AI ActNIST AI RMF
Visit the Trust Center

Govern the model, not just the agent.

Put every provider — hosted or local — behind one broker that routes by policy, caps by budget, and proves every choice.

Book a demoExplore the platform