Skip to main content
The approved model-access target routes sandboxed model calls through a proof-bound gateway without a platform provider credential entering the sandbox. Envoy owns the HTTP data plane. A small Hiloop control service verifies the short-lived Pod-bound workload proof, enforces organization policy and budget, and selects the authorized credential; Envoy applies that decision outside the workload and streams the request with hard byte and time bounds. The target can route to a public provider or to your own in-boundary inference endpoint. Compatible provider subscriptions use a separate provider-native route through the same proof boundary rather than bypassing it. Direct provider access from a sandbox is not a supported fallback. The current public-egress floor does not yet deny every provider destination, so a raw credential could bypass this product boundary mechanically. That path is unsupported, exposes plaintext to the workload, and receives none of the gateway guarantees. Provider-destination denial remains an acceptance gap for the target.

​
Current status

Clean sandbox model access is unavailable today. The existing Rust body proxy is an operator-only implementation aid, not the approved sandbox transport. Do not connect sandbox workloads to it or treat installing its chart as enabling supported sandbox model access. It serves the streaming OpenAI Responses API with byte, time, and process-local budget limits, but does not establish the external proof-bound request path. The generated model-gateway chart reference documents this operator-only proxy. It is not an installation guide for the sandbox target.

​
Target acceptance

The sandbox path is ready only after a live conformance lane proves all of these together:
  • invalid, expired, wrong-namespace, wrong-service-account, and wrong-incarnation workload proofs are rejected;
  • organization policy, route selection, and hard budget admission are enforced by the Hiloop control service before Envoy applies any credential mutation;
  • managed credentials never appear in sandbox environment, command, workspace, image, Kubernetes Secret, response body, or platform telemetry;
  • compatible subscriptions preserve their provider-native request and response protocol through the proof-bound gateway;
  • direct provider egress is denied, including raw TLS and literal-IP bypasses; and
  • no deployed gateway means model access fails closed.