Enterprise Tier
Project and data plane management
Isolated projects are created here, the data planes that serve them are deployed, each data plane is labelled with the projects it serves, and projects are moved between data planes without disruption. Models must be enabled in the organization catalog before they can be granted to a project; that catalog work is covered in Provision models and providers.
Three objects underpin these guides; the full treatment is in Key concepts and Planes and core components.
- A project is the logical boundary that owns models, API keys, Model Context Protocol (MCP) servers and profiles, routing and policy, budgets, and members. It is also the isolation boundary: each request resolves to its project from its API key, and a project sees and serves only its own configuration.
- A data plane is the request-path deployment, running in a Kubernetes cluster, that contains the Controller and the AI Gateway proxy. Since 0.7.0 it lists the hostnames it serves in its own Helm values (its declared hostnames) and reports them to the management plane. One management plane can manage many data planes.
- A project label connects the two. A platform administrator labels a data plane with each project it serves, and the data plane then serves the configuration of every project labelled on it. One data plane, and one hostname, can serve several projects, and one project can be served from several data planes. A project has no callable address until at least one data plane is labelled with it.
Data planes before 0.7.0 cannot declare hostnames. They keep the address stored for them through the management plane and serve projects through gateways, as described in each guide's section for earlier data planes.
Set up a project
Create and delete a project
Create the project with the wizard, granting members, models, MCP servers, and data planes in one pass, or delete a project when it is no longer needed.
Serve a project from a data plane
Give the project a callable address by labelling a data plane with it, and confirm the data plane has served it.
Manage project Users and access
Add Users, assign roles, and keep project access separate from data-plane operations.
Issue a project-scoped API key
Create a key that resolves to one project on every endpoint that serves it.
Grant MCP servers and profiles to a project
Scope MCP servers and profiles to a project under the same isolation as models.
Operate data planes
Deploy and register a data plane
Provision a data plane, install its credential, declare its hostnames, and connect it to the management plane.
Manage a data plane's addresses and projects
Read the addresses a data plane reports and edit the projects labelled on it.
Move a project to another data plane
Serve the project from a new data plane under the same hostname, then remove the old label.
Serve a project from two data planes
Run a high-availability pair that declares one hostname behind a GSLB or health-checked DNS.
Gateway sets and DNS-level failover
Run a project on several like-configured gateways and fail over between them with customer-managed DNS, including data planes before 0.7.0.
Declare the hostnames a data plane serves
List the hostnames in the data plane's Helm values, then wire DNS, a certificate, and a load balancer route for each.