Every model call, checked before it ever leaves.
The Model Gateway is Kryex's governance layer for the brain — every model call, from every developer, passes through it before reaching an upstream provider. Six things happen, in order, on every single call.
What happens on every call
Authenticate
The caller is authenticated via a short-lived Kryex license — not a raw provider API key. Clients never see or hold upstream credentials for gateway-routed models.
Check live account status
A suspension in the admin panel takes effect immediately on the very next call — not after a license expires up to 24 hours later. This live re-check, rather than trusting a cached claim inside the license token, is deliberate: administrative control has to be immediate to be meaningful.
Resolve model access
Is this model enabled at all, and is this specific user either granted access to it directly or covered by an "open to all" policy the administrator set?
Enforce quota
Checking a per-user-per-model override first, falling back to the customer's tier-based daily allowance if no override exists. A user who hits their limit gets a clear, structured response telling them exactly when it resets and how to request more.
Proxy the call
Translating transparently between wire formats where the upstream provider's API shape differs from the client's, and streaming the response back exactly as the client expects.
Record usage
Tokens in, tokens out, latency, and outcome — against that user and model, for both the administrator's usage dashboards and that user's own quota accounting, without ever blocking or slowing the completion the developer is waiting on.
Requesting more access, without friction
When a developer hits a quota or access wall, the agent can surface a one-click “request more access” affordance directly in the client. That request lands in the administrator's approvals inbox with full context; granting it — or extending the user's quota — both unblocks the user immediately and automatically resolves the pending request, so an administrator never has to separately dismiss a request they've already satisfied through a grant.
The Model Gateway governs the brain — the prompt and completion. It doesn't know or care what the model's output is used for afterward; that's the Tool Proxy's job, covered in Tool Calling & Governed Actions. Together they're the two chokepoints described in How Kryex Works.
Why the live check, specifically
Suspending someone should mean something immediately
Most token-based auth trusts a claim baked into the token at issuance — a license or session token can be valid for hours after an administrator decides someone shouldn't have access anymore. That gap between 'admin clicked suspend' and 'access actually stops' is exactly where damage happens.
The Model Gateway re-checks account status live, on the actual request — never from a cached claim inside the license. A suspension takes effect on the very next call, not after a token expires up to 24 hours later.
An administrator suspends a departing contractor at 2:00 PM. Under a cached-claim approach, their still-valid license keeps working until it naturally expires — potentially the next day. Under Kryex, their very next model call is denied at 2:00 PM.
Administrative control is immediate, not eventual — the gap between a decision and its effect is one request, not up to a day.
The Model Gateway is Kryex's equivalent of what the industry calls an AI gateway — a distinct layer from a traditional API Management (APIM) gateway. If your organization already runs one, see Kryex & API Management (APIM) for how the two fit together.