Skip to content
Clovie
Talk to sales
Gateway and routing

The governed path for every model call.

Agents keep their SDKs and change one base URL and one key. Every request is identified, checked, routed, forwarded with your provider key and recorded. Agents you can’t change are routed through your network, or through the gateway you already run.

Talk to salesHow it works
The problem

Every team calling providers directly means no one is in control.

Provider keys everywhere

Keys copied into code and CI give every agent the power of the whole account.

No single choke point

Policies, budgets and kill switches need one place where every request passes.

Gateways you already own

Platform teams have invested in Kong, Apigee or Envoy and won’t move every agent to a new address.

Clovie is both a gateway and a decision service. Use the Clovie gateway, or keep your own and let it ask Clovie before each request. Either way, one set of policies applies and coverage is labelled honestly.

How it works

Four ways in, one set of checks, every provider behind your own keys.

Ways inExplicit endpointchange base URLZero-code routingDNS or proxyAgent front doorvendor agent APIsCopilot Studiotool-call checksGatewayIdentityagent key, workloadAccess groupsallowed modelsCheckspolicy, budget, guardrailsRoutingrules and fallbacksProvidersFrontier modelsyour provider keysSelf-hosted modelscustom endpointsMCP toolsgoverned tool callsWays inExplicit endpointchange base URLZero-code routingDNS or proxyAgent front doorvendor agent APIsCopilot Studiotool-call checksGatewayIdentityagent key, workloadAccess groupsallowed modelsCheckspolicy, budget, guardrailsRoutingrules and fallbacksProvidersFrontier modelsyour provider keysSelf-hosted modelscustom endpointsMCP toolsgoverned tool calls

See it at work

Product tour · demo data
Clovie · Activity · Audit log
Audit log
TimeAgentModelDecision
14:02:11Card Dispute Triagegpt-4oDeny
14:01:58Fraud Alert Triageclaude-sonnet-4.5Allow
Decision403 policy_denied
Policy
Card numbers stay out of prompts
Mode
Enforcing
Reason
Card number found in the prompt
Provider call
Not made
Request
UserCustomer disputes a charge on card [CARD-1]. Draft a reply.
Clovie · Costs · Ledger
Costs
Spend this month
$41,280
at your negotiated rates
Card Dispute Triage · month
$1,240
Blocked before the call
$0.00
no provider cost
AgentTeamTokensCost
Card Dispute Triagethis request, blockedCards & Payments0$0.00
Fraud Alert TriageCards & Payments18,420$0.31
KYC Document ReviewKYC Operations42,905$0.74

One change in the agent

Point any OpenAI- or Anthropic-compatible SDK at Clovie with the agent’s own key. Errors say which check stopped the request and why.

from openai import OpenAI
import os

client = OpenAI(
    base_url="https://gateway.example.com/v1",
    api_key=os.environ["CLOVIE_AGENT_KEY"],
)

reply = client.chat.completions.create(
    model="anthropic/claude-sonnet-4.5",
    messages=[{"role": "user", "content": "Summarise this dispute."}],
)

Allowed, priced, recorded
HTTP/1.1 200 OK

{
  "id": "chatcmpl-…",
  "model": "anthropic/claude-sonnet-4.5",
  "choices": [{ "message": { "role": "assistant", "content": "…" } }]
}
Key capabilities

What you get

Native APIs

Chat Completions, Messages and Responses, plus embeddings, images, audio, moderations, rerank, files and models, so OpenAI and Anthropic SDKs work unchanged.

Four ways to connect

Explicit endpoint, zero-code routing through your DNS or proxy, an agent front door for vendor agents, and Copilot Studio runtime protection.

Your gateway, our policies

Kong, Apigee, Azure API Management, Envoy and Istio, agentgateway, LiteLLM, Portkey, NVIDIA NeMo Relay and Bedrock AgentCore enforce through callouts; any OpenTelemetry source can be observed.

Routing and fallbacks

Route by tags, agent, team, environment or region, and fall back to other allowed models when one fails.

Access groups and rate limits

Named groups of approved models for agents, teams and keys, with request and token limits per organization, agent key and developer key.

Agent identity

One key per agent with automatic rotation, or workload sign-in with Kubernetes and cloud identities instead of stored keys.

Also in this layer

CapabilityWhat it does
MCP and A2ARegister MCP servers, govern tool calls, turn internal REST APIs into governed MCP tools, and route Agent2Agent calls through the gateway.
Coding agentsStart Claude Code, Codex, Gemini CLI or aider governed from the first request, with developer sign-in through your identity provider.
Built for the request pathLoad shedding with Retry-After instead of slowdowns, fair sharing between organizations, and a liveness check that answers under load.
Frameworks

Controls mapped to the frameworks you answer to

  • SOC 2: SOC 2 Type II trust services criteria
  • NIST AI RMF: NIST AI Risk Management Framework
  • EU AI Act: EU Artificial Intelligence Act
  • OWASP Top 10: OWASP Top 10 for LLM applications and agentic AI
Deployment

Runs wherever Clovie runs

  • SaaS
  • Customer VPC
  • On-premises
  • Air-gapped

The hosted gateway serves SaaS. In self-hosted installs the gateway runs in your network; zero-code routing and gateways in your network are part of a self-hosted or hybrid install.

Questions

Questions

What happens if Clovie can’t check a request?

Your organization decides: continue with an alert (the default) or refuse requests until checks are back.

Do agents ever see our provider keys?

No. Agents use their own Clovie key. Only Clovie holds provider keys and uses them to call the provider.

Can we keep our existing AI gateway?

Yes. Supported gateways ask Clovie before forwarding each request and can send answers back through Clovie. Others can send telemetry to be observed and priced.

Which models can an agent use?

Only models your organization has enabled in the catalog and placed in the agent’s access group. Others return a clear error.

Put one governed path between your agents and every model.

See gateway and routing on your own agents, in the deployment you need.

Talk to salesAll layers