> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Model gateway

> The approved proof-bound sandbox model-access target and today's operator-only proxy.

The approved model-access target routes sandboxed model calls through a proof-bound gateway without
a platform provider credential entering the sandbox. Envoy owns the HTTP data plane. A small Hiloop
control service verifies the short-lived Pod-bound workload proof, enforces organization policy and
budget, and selects the authorized credential; Envoy applies that decision outside the workload and
streams the request with hard byte and time bounds.

The target can route to a public provider or to your own in-boundary inference endpoint. Compatible
provider subscriptions use a separate provider-native route through the same proof boundary rather
than bypassing it.

Direct provider access from a sandbox is not a supported fallback. The current public-egress floor
does not yet deny every provider destination, so a raw credential could bypass this product boundary
mechanically. That path is unsupported, exposes plaintext to the workload, and receives none of the
gateway guarantees. Provider-destination denial remains an acceptance gap for the target.

## Current status

Clean sandbox model access is unavailable today. The existing Rust body proxy is an operator-only
implementation aid, not the approved sandbox transport. Do not connect sandbox workloads to it or
treat installing its chart as enabling supported sandbox model access. It serves the streaming
OpenAI Responses API with byte, time, and process-local budget limits, but does not establish the
external proof-bound request path.

The generated [model-gateway chart reference](/reference/helm/model-gateway) documents this
operator-only proxy. It is not an installation guide for the sandbox target.

## Target acceptance

The sandbox path is ready only after a live conformance lane proves all of these together:

* invalid, expired, wrong-namespace, wrong-service-account, and wrong-incarnation workload proofs
  are rejected;
* organization policy, route selection, and hard budget admission are enforced by the Hiloop
  control service before Envoy applies any credential mutation;
* managed credentials never appear in sandbox environment, command, workspace, image, Kubernetes
  Secret, response body, or platform telemetry;
* compatible subscriptions preserve their provider-native request and response protocol through
  the proof-bound gateway;
* direct provider egress is denied, including raw TLS and literal-IP bypasses; and
* no deployed gateway means model access fails closed.

## Related pages

* [Architecture](/concepts/architecture#credentials) — the approved target and current gap.
* [Security model](/deployment/security-model) — current controls and unavailable paths.
* [model-gateway chart reference](/reference/helm/model-gateway) — the operator-only Rust proxy.