Product · Gateway
Set access and spend limits on the AI traffic you route through Tallin.
Give selected apps, agents, and developer tools an approved model scope and budget. Tallin evaluates routed requests, records the outcome, and lets you pause one workload's access.
Gateway controlsExample workspaceFor requests routed through Tallin
Check the request. Apply the rule.
- 01Support agentNamed owner + key
- 02Tallin GatewayModel + budget checks
- 03Approved providerRequest forwarded
The model is approved and the configured budget check passes.
The control decision is recorded against the agent. Requests sent directly to a provider do not pass through this check.
Tallin routes according to the gateway key's configured provider and permitted managed model family or tier. It does not autonomously switch models based on prompt content.
In the request path
A policy check before the provider call.
- Identify
- Attribute each routed request to a named actor and owner. Helper tokens support employee attribution for managed developer tools.
- Evaluate
- Apply configured model scope, budget caps, rate limits, and anomaly freezes. Allow, reroute, or block according to your configuration.
- Record
- Keep the actor, model, route, cost evidence, policy outcome, and failed attempts in the operational record.
- Pause
- Disable an actor's Tallin-mediated model access without disabling unrelated workloads.
Capture choices
Choose what the gateway stores.
Metadata-only mode stores the operational record without prompt or response content. Full-content capture is an explicit option for deeper review.
SaaS gateway traffic is still processed in memory so Tallin can route it. Only self-hosted/VPC deployment fully removes Tallin-hosted data-plane visibility.
- Metadata-only
- Actor, provider, model, time, route, cost, and policy outcome. Metadata-only mode stores no prompt content.
- Full-content
- Configured prompt and response content is retained in addition to metadata. Confirm access and retention requirements during setup.
- Content controls
- Model and spend controls do not imply prompt-level PII blocking. Content-level enforcement is on the roadmap.
Deployment
Hosted, or in your own VPC.
Tallin-hosted
Tallin operates the gateway and applies configured controls centrally. Routed content is processed in memory; retained content depends on the capture mode you select.
Customer VPC
The gateway runs in your environment and applies synced policy locally. Provider-bound requests still reach your configured AI provider. Tallin receives only agreed content-free metadata, not prompts or responses. The gateway fails closed on stale configuration.
Both deployments enforce only the traffic routed through them. Provider APIs may separately report direct calls, but Tallin Gateway cannot block those calls or tool and MCP side effects outside its request path.
Compatible routes
Use the SDK formats your team knows.
| Route | Format | Use case |
|---|---|---|
/v1/messages | Anthropic Messages | Claude Code and Anthropic SDK calls |
/v1/messages/count_tokens | Token count | Audit evidence without spend |
/v1/responses | OpenAI Responses | Codex and OpenAI SDK-compatible apps |
/v1/chat/completions | Chat Completions | Existing OpenAI-compatible app traffic |
Start with one routed workload.
Confirm the provider route, assign an owner and budget, then inspect an allowed request and a blocked request before expanding.