Every token, every dollar,
every decision.
The enterprise access layer between your applications, agents and people and your sovereign Token Factory. Identity and governance, model right-sizing, output verification and human approval gates — and nothing reaches your systems without a verdict.
docker compose -f deploy/lite/docker-compose.yml up --buildThe gateway never serves inference itself. It governs the path to the model.
One governed path to the model
Applications, agents and CI all reach the model through one origin. Every request carries an identity, is checked against a policy and a budget, is routed to a model you allowed, and leaves a metadata-only record behind. The gateway is consumer-side: it sits inside your blast radius, adjacent to the workloads it governs, and talks to your Token Factory over a private interconnect.
app / agent / CI ──► iag-lite ──► your Token Factory ──► model serving
│
├─ 1 wire hygiene body cap, strip inbound identity headers fail closed
├─ 2 gate virtual key → principal, allowlist, budget fail closed
├─ 3 exact cache scoped by workspace + principal + policy fail open
├─ 4 trim tool pruning, dedup, history window fail open
├─ 5 route alias or cascade over allowed models fail open
├─ 6 invoke streaming, reassembled for the stages after
├─ 7 verify structural checks, tool gates, approvals
├─ 8 meter usage × your contract rates → cost, savings
└─ 9 record one metadata-only row, live feed cursor/v1/chat/completionsany OpenAI SDK, streaming included
/v1/messagesbearer or
x-api-key, SSE reframed
keys · policy · budgets · audit
Four groups, and what is actually in them
Each group below is a set of mechanisms that run on the request path, not a roadmap. Where something is design intent rather than a delivered feature, it says so here and on the page it belongs to.
Control
Virtual keys minted per principal with a TTL, a model allowlist per workspace, spend caps per workspace or principal with a configurable posture, and an admin surface on its own listener. A request that names a model you did not allow is refused before it costs anything.
Efficiency
In order of how much they actually save: prefix stability so the provider's cache keeps hitting, an exact response cache scoped so a hit can never cross a tenant, and right-sizing onto a smaller model when the caller asks for it. Cached prompt tokens are priced at your contract's cached rate, not guessed at.
Trust
Every answer carries a verdict and a confidence score from named structural checks. Risky tool calls are held for a human, with the approval persisted alongside the actor, the reason and the time, and written into a hash-chained evidence ledger.
Edge and scale
The same middleware chain is written once and hosted three ways: in-process for this single-container profile, as an Envoy filter pair at platform scale, and as a single-binary edge router. The edge profile exists as a design and a binary; it does not yet invoke a model, and that is a named gap rather than a headline.
And what we deliberately do not
A number belongs on this site only if the gateway's own counters can reproduce it against a live upstream. Everything in the right-hand column is a claim a buyer could disprove in an afternoon, so we do not make it.
| The question | What we say | What we do not say |
|---|---|---|
| Does it cut my AI bill? | Yes, and it shows you where. Repeated prompt prefixes are served from the provider's cache and the share is on a dashboard tile. Routing a routine sub-task to a smaller model saves the rate difference between the two. | "50% guaranteed." The number depends on your prompts and your contract rates. The gateway makes it visible rather than promising it. |
| Is every answer checked? | Every answer carries a verdict and a confidence score from structural checks, and every risky tool call is held for a human before it reaches your systems. | "99.9% accurate." Nothing in the product measures accuracy, so nothing in the product may claim it. |
| Is it faster? | Repeated questions return instantly from cache. Everything else runs at the speed of the model behind it, plus a few milliseconds of gateway. | "2× faster." We add latency; we do not subtract it. The gate's overhead has a stated target and the record carries the real number. |
| Does it run inside my walls? | Yes. One container plus a database, no runtime dependency outside your network, and the admin surface on a separate private port from the one your applications use. | "Zero-trust out of the box." Listener TLS terminates at your ingress, not in the container, and the deployment guide says so. |
Each row is backed by a measurement you can rerun on your own traffic. The method, the raw counters and the cases where the result went against us are on the evidence page.
Three results that changed the product
All three were measured against a live Token Factory with the gateway's own counters. Two of them retired a feature we had been describing as a saving.
The provider's cache is the lever
A stable prompt came back 98% served from cache on every call after the first. Putting a single timestamp at the front of the same system prompt dropped it to the block baseline. So the gateway keeps prefixes byte-stable and moves per-request values out of them.
History windowing lost to it
When trimming fired on a ten-turn conversation it removed 2,163 real tokens and dropped the cached prefix from 5,088 tokens to 80 — tripling the full-price tokens. It now runs only when a context would not otherwise fit, and it is not a savings claim.
No classifier beat "just use the small tier"
Three candidate routers were measured against the question that matters: will the cheap tier get this right. None beat sending everything to the small tier. So routine-ness is declared at the call site with an alias, rather than guessed per request.
One container, one database, four secrets
The gateway boots fail-closed. An unset admin token, a short signing key, a missing upstream credential, an unreachable database or IdP each exit non-zero naming the config field rather than starting in a degraded state.
Set the four required secrets
Compose refuses to start without them. Nothing has a default.
export TF_KEY=<your Token Factory key>
export IAG_ADMIN_TOKEN=$(openssl rand -hex 24)
export IAG_SIGNING_KEY=$(openssl rand -hex 32)
export IAG_UPSTREAM_BASE_URL=https://<factory-origin>Bring it up
Postgres, the gateway and a stub IdP for local boot checks.
docker compose -f deploy/lite/docker-compose.yml up --buildCreate a workspace, publish a policy, mint a key
Three calls against the admin listener. The key is shown once.
curl -s -H "$A" -X POST localhost:8081/admin/v1/workspaces \
-d '{"name":"ws-pilot","tf_project_id":"proj-1"}'Point an SDK at it
Any OpenAI or Anthropic client works unchanged. The response carries the routed model, the cost, the verdict and the trace id in headers.
curl -si localhost:8080/v1/chat/completions -H "Authorization: Bearer $KEY" \
-d '{"model":"iag/auto","messages":[{"role":"user","content":"Say hello."}]}'The full walkthrough, the config schema, the response headers and the production notes are in the installation guide. Source and container images are distributed to customers and partners under licence; this site documents the process rather than publishing the build.
Govern the path, not just the prompt
Start with the installation guide to get a gateway running against your own Token Factory, or read the architecture first if you want to know exactly what runs on the request path before you install anything.