Agent Router Enterprise guides
Enterprise Tier
Goal-oriented guides for running Tetrate Agent Router as a shared service: admitting people and mapping what they may do, seeing what the traffic costs and where it goes, and governing the projects, models, spend, and safety controls behind it. Unless a guide says otherwise, the work is done in the Admin Console by a platform operator.
A new deployment is usually set up in this order: establish the project that owns models, keys, and gateways; provision the providers and models the project routes to; then onboard the developers who consume them and map their access from the identity provider. Cost controls, guardrails, telemetry export, and compliance settings are layered on afterward and can be read in any order as the need arises.
Guides for the developers consuming the gateway are collected separately under Guides for developers.
Identity and access management
Connect the identity provider, then decide what the identities it supplies are allowed to do.
Configure SSO
Connect an OIDC identity provider so people sign in with corporate credentials.
Configure SSO role mapping
Translate the claims an identity provider sends into Agent Router roles.
Map Entra groups to functions
Drive access from existing Entra ID groups rather than a parallel membership list.
Manage roles and permissions
Review the available roles and the permissions each one carries.
Observability and analytics
Read what the traffic is doing inside Agent Router, then send the same signals to the observability stack the organization already runs.
Monitor traffic and usage
Request logs and usage analytics: find one request, verify an integration, and read aggregate behavior.
Export telemetry to observability
Send traces and metrics to Grafana, Datadog, New Relic, or another OpenTelemetry consumer.
Custom observability backends
Point the exporters at a backend that is not one of the presets.
Operate and govern
These areas cover the day-to-day operation of the service and the controls placed around it. Each one collects several goals; the individual goals are listed together under Guides for platform operators, which also carries the standalone tasks such as onboarding developers, governing Model Context Protocol (MCP) server access, and auditing activity.
Project and data plane management
Create the isolation boundary that owns models, keys, and gateways, then provision and operate the data planes that host them.
Provision models and providers
Configure provider connections, enable the models developers route to, and grant them to a project.
Cost and quota management
Pick between budgets, rate limits, and attribution tags, then track spend against a budget (enforcement is opt-in) and bill it back.
Safety and data protection
Enforce guardrails inline: redact sensitive data, block prompt injection, and protect coding assistant traffic.
Compliance and governance
Set data residency and retention, and export audit and policy decisions to a SIEM.
Before the guides apply
These guides assume a running deployment. Where one does not exist yet, start with the installation path that matches the deployment model.