AI Gateway
The Stacklok AI Gateway is a self-hosted enterprise gateway that sits between your AI tools and large language model (LLM) providers. Deployed in your environment, every AI request hits your policy, identity, and audit controls before it reaches a provider. It gives platform and security teams a single control point for cost, compliance, and access to models like those from OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, and Google Vertex AI.
The AI Gateway is part of Stacklok Enterprise. It complements ToolHive: ToolHive governs the tools your agents can use, while the AI Gateway governs the models they can call.
What you can do
- Cap AI spend in real time with token and cost budgets per user, team, agent, or org, reconciled to your finance team's reporting cycle
- Block PII, financial data, regulated identifiers, and your own custom patterns at the gateway, with fail-safe denial when policy can't be enforced
- Capture every LLM request in an audit trail and stream it to your security information and event management (SIEM) system
- Route logical model names across multiple providers with failover
- Tie every request to an identity from your IdP, with provider keys locked in the gateway and access revoked on the next request when a user or agent is offboarded
- Govern people and agents as first-class peers under the same policies, budgets, and audit trail
The AI Gateway is configured declaratively through two Kubernetes custom resources and administered through a REST management API. It ships as part of the Stacklok Enterprise Helm chart.
Next steps
- Deploy the platform to install the AI Gateway in your Kubernetes cluster.
- AI Gateway CRD reference
for
AIGateway, which configures providers, routes, screening, and resilience, andAIPolicy, which attaches policy to a gateway. - Management API reference for the models, policies, and MCP server endpoints.