Gateway routing
Route provider calls from workstations through an LLM gateway, with keys bound to the person and process.
Turn on gateway routing
Configure it under Policy → Gateway routing. Choose an LLM gateway and, for each provider family (Anthropic, OpenAI, Gemini), the provider whose credential the gateway uses.
With routing on, provider calls from the workstation go through your gateway, so its budgets, rate limits, content policies, and usage accounting apply to them. Routed calls are captured by the guard and attributed to device, user, and process.
Managed harness settings
The service also writes managed settings for supported harnesses so they use the gateway directly. These are merged into existing files and restored exactly when routing is turned off or the device is removed.
| Harness | What Sentinel manages |
|---|---|
| Claude Code | Base URL, CA trust, and a key helper, in its managed settings file. |
| Gemini CLI | API-key authentication, in its system settings file. |
| Codex | A per-run gateway key from the launcher, and policy hooks from its requirements file. |
Run-bound keys
The service requests gateway keys with the device credential, which never leaves the service. Each key is pinned to one provider family, lives for 8 hours by default (12 at most), and is tagged with the device, OS user, mapped platform user, and process. Gateway budgets and usage therefore attribute to the person.
A user can fetch their own key over the local socket:
exo-sentinel gateway-key --family anthropic
Issuing a key requires that the person who created the device's enrollment still has permission to invoke the gateway. If that grant is revoked or the account is disabled, key requests are refused.
What happens to each request
With a provider family routed, the guard handles requests from any process as follows.
| Request | Outcome |
|---|---|
| Anthropic, OpenAI, and Gemini model APIs | Sent to the gateway, with the client's own credential (personal API key or subscription login) replaced by a gateway key. |
| Codex signed in with ChatGPT | Sent to the gateway. |
| Subscription-only account and sign-in endpoints | Refused with a 403 explaining that the organization's gateway is used. |
| Cursor, Copilot, and Windsurf backends | Refused with a 403 unless you exempt the vendor. Exempted vendors' traffic is captured, not routed. |
| Calls made to the gateway directly | Captured and recorded as routed. |
To stop applications other than supervised runs from reaching AI services at all, use Allowed applications on the network guard. Gateway routing alone does not turn it on.