Why we re-check access on every model call instead of trusting the token

Every request from Kryex Code to a model carries a signed license. We could trust it: check the signature, read the claims inside, let the call through. We decided not to rely on that alone. Every call through the Kryex Model Gateway also checks the live account. Here's why.

The gap in token-based access

Signed tokens are a good way to prove who someone is without asking a database every time. The catch is in the word “every”. A token's claims are true at the moment it was issued. If an administrator suspends a person five minutes later, the token doesn't know. It stays valid until it expires.

Kryex licenses are RS256-signed and last 24 hours. Trusting the token alone would mean a suspension could take up to a day to bite. For a contractor whose engagement just ended, or a laptop that was just reported lost, that's the wrong answer.

What the gateway checks, every call

The signature still matters — an expired or invalid license is refused outright. But on top of it, each call reads the current state of the caller in a single database query:

• Is the account active? A suspended account is refused on its very next call.
• Is it on the block list? Blocked accounts are refused.
• Is this device still trusted? A device an admin revoked, or one signed out after the license was issued, is refused.

Only then does the gateway resolve whether the person may use this model and whether they have quota left, and only then does the call go to the provider — whose key the client never sees.

The cost, and why it's worth it

A database read on every model call isn't free. Pure token validation is cheaper, and at very high volume the difference is real. We think it's the right trade for this product, for a simple reason: the whole point of an administrator's decision is that it takes effect. A control that works “eventually” is a control you can't rely on during the one hour it matters.

It's the same principle as the rest of Kryex: the decision is made where the authority is, at the moment of the action — not cached somewhere it can go stale.

Refusals that explain themselves

Live checks shouldn't mean mysterious failures. When the gateway refuses a call, it says why. A person without access to a model gets a clear model-access error. A person over their token limit is told exactly when it resets and which other models they can still use, and they can request more from inside the app — a request that resolves itself the moment an admin grants it.

The principle

Prove identity with a token; decide access with live state. If you're evaluating any AI gateway, ask one question: if I suspend someone right now, when does their next call fail? The answer tells you whether the admin console is a control or a suggestion.

More on the gateway in Model Gateway for AI Coding Agents.