Skip to content
Halo by OmniTrust

Secure · Model Gateway

Available now· AI gateway for your own apps is in preview

One gateway for the models your agents call

The Halo model gateway brokers model requests for your agents. Choose a Halo-managed model or bring your own key, and apply identity, policy, budgets, and evidence to the traffic in either mode.

Book a walkthrough Start with Halo
BYOK providers your admins connect themselves
50+
providers available with guided setup
100+
AI gateway for your own applications
Preview

Why it matters

Model access spreads across keys and accounts

Each team that signs up with a model provider adds another key, another bill, and another place where requests go unrecorded. Security and finance often find out only after something goes wrong.

  1. 01

    Provider keys copied into apps and agent settings are hard to track, rotate, and revoke.

  2. 02

    Model requests carry prompts and context, and policy has nowhere to look at them without a gateway in the path.

  3. 03

    Costs land on provider invoices without a view by agent or model.

How it works

How a model request flows

The same path serves Halo-managed models and your own provider keys.

  1. 1

    Choose a model mode

    Pick a Halo-managed model or BYOK for each agent. In BYOK mode your provider key is stored as a write-only secret bound to the agent.

  2. 2

    Send the request

    The agent runtime routes model requests to the Halo model gateway, which identifies the agent and resolves the model route and credential.

  3. 3

    Evaluate and decide

    The gateway checks policy, approvals, and budgets and runs request classifiers in supported paths. A denied request returns an error, and a held request waits for a reviewer.

  4. 4

    Call, check, and record

    The gateway calls the provider with the brokered credential, checks the response in supported paths, and records usage, cost, and the decision.

Capabilities

Governed model access in one place

The gateway sits between agent runtimes and model providers, so identity, policy, budgets, and evidence apply to model traffic.

  • Halo-managed models

    Use a Halo-managed model with no provider key to set up. Halo-managed models run through Amazon Bedrock and are billed through Halo credits.

  • Bring your own key

    Account admins connect keys for OpenAI, Anthropic, Google Gemini, Cerebras, GMI Cloud, and dozens of other providers themselves. Halo brokers each key at the gateway, and your provider bills you directly.

  • Same controls in both modes

    Policy, approvals, budgets, and evidence apply whether an agent uses a Halo-managed model or your own key.

  • Request and response checks

    Policy can evaluate model requests and responses, and runtime classifiers for PII, secrets, and prompt injection apply in supported gateway paths.

  • Budgets by agent

    Account and per-agent budgets apply where model usage happens, and cost analytics break spend down by agent and model.

  • Evidence for model use

    Gateway decisions record the agent, the model, the policy that applied, and the outcome, and they export as CSV and JSON.

Managed or BYOK

Choose where models and keys come from

Halo-managed models remove credential setup, and BYOK lets teams keep an existing provider contract. Requests pass through the same gateway in both modes. Admins connect dozens of providers themselves, and the gateway is built to add providers quickly, so 100+ providers are available with guided setup.

  • Halo-managed models need no provider key
  • Self-serve BYOK for OpenAI, Anthropic, Gemini, and 50+ providers
  • 100+ providers available with guided setup
  • Policy and evidence match in both modes

FAQ

Questions, answered

Account admins can connect their own keys for OpenAI, Anthropic, Google Gemini, Cerebras, GMI Cloud, and dozens of other providers themselves. The gateway is built to add providers quickly, so 100+ providers are available with guided setup. Talk with our team about your provider before you plan around it.

Halo-managed models are models that Halo provides through Amazon Bedrock. You choose from a managed model catalog, you do not need a provider credential, and usage is billed through Halo credits.

An AI gateway for your own applications, which accepts external traffic, is in preview. Agents you launch through Halo use the model gateway today. If you want to try the preview for your own apps, ask our team about access.

Yes. Identity, policy, approvals, budgets, and evidence apply to agent traffic through the gateway in both modes. With BYOK, your provider bills you directly, and Halo still brokers the key at the gateway.

Gateway decisions record the policy that applied, the outcome, and the reason, and usage and cost are attributed by agent and model. Audit logs and gateway decisions export as CSV and JSON for review.

Related capabilities

Model RoutingRoute requests to the right approved modelLearn more about Model RoutingBudgets and Cost ControlsBudgets that notify, pause, or stopLearn more about Budgets and Cost ControlsRuntime GuardrailsDetect sensitive data and injectionLearn more about Runtime Guardrails

Put a halo around the AI your business runs.

See discovery, runtime policy, approvals, and evidence working together on your own use cases.

Book a walkthrough Start with Halo