Façades in. One model through.

Six things that are first-class, not inferred

In an HTTP-shaped gateway these are derived from a path, a header or a provider SDK's behaviour. Here they are fields on a domain object, which is why policy, routing, caching and accounting can reason about them uniformly.

That one decision is why chat, embeddings, vision, audio, async video jobs and realtime sessions share a single policy, routing and accounting path instead of six.

Speak the dialect, keep the fidelity

Clients send OpenAI, Anthropic or Gemini-shaped requests, or the native inference-request shape directly. Native adapters preserve provider-specific behaviour — tool calling, vision, structured output — rather than flattening everything through one lowest-common-denominator shape and losing capability at the edges.

Nine stages, in a fixed order

Every request moves through the same stages. Identity, model access and budget resolve before anything is called; input policy runs before the cache, so even a cached answer is screened; routing picks the deployment; output and tool policy run on the answer; cost, verdicts and evidence land on the way out.

1. 01
   Authenticate

   Virtual key, agent token, or a corporate IdP token on /v1 (Enterprise). Resolves org, team, user, application and agent run.

   ✗ 401
2. 02
   Model access

   Model grants, narrowed by the key's allow-list, decide which aliases this identity may call.

   ✗ 403
3. 03
   Budget

   Rate limits and budgets are reserved on key, org, team, user, application and model. All of them must pass.

   ✗ 429 — no provider spend
4. 04
   Policy (pre-call)

   Ordered guardrail chain on the input: PII, injection, moderation, or your own webhook. A masked prompt is what the cache sees.

   ✗ BLOCK · ◑ MASK · ◐ REDACT
5. 05
   Cache

   Exact → canonical → near-dup → semantic, each tier gated against false hits. A hit skips the provider and the output stages.

   ✓ HIT — return, no provider call
6. 06
   Route

   Capability filter, residency, session affinity, then the routing strategy picks the deployment. A failover never leaves the allowed jurisdictions.

7. 07
   Invoke

   Provider dialect, true SSE streaming, same-alias failover, then ordered fallbacks; each attempt writes a ledger egress entry. Mid-stream policy runs on a rolling window.

8. 08
   Policy (post-call)

   Output guardrails run on the full answer. Tool calls the model hands back are judged by tool policy: allowed, removed with a note, or refused.

   ✗ 403 · removed
9. 09
   Account

   Budgets settle, the ledger records the outcome, and tokens, cost, verdicts and the routing decision land as request logs, OTEL traces and Prometheus metrics.

A proxy forwards a request. This decides what the request is allowed to be — which is the whole distinction between a gateway and a control plane.

Four lifecycles, one policy path

Because lifecycle is a field on the request rather than an implementation detail of an endpoint, the same governance applies to all four.

This is the part an HTTP-shaped gateway cannot retrofit without a rewrite. Lifecycle has to be in the domain model before policy can apply to it uniformly.

Four planes, separated on purpose

Kubernetes-native, not Kubernetes-compatible

Anything in a container is Kubernetes-compatible. Native means the platform models the thing you are running: Wäg ships its own operator and custom resources, so the gateway is an object the cluster understands rather than a deployment somebody wired up. A WaegInstance owns the gateway's Deployments, networking, autoscaling and monitoring, and reports a misconfiguration as a condition with a reason; providers, models, organizations, budgets, guardrails and keys can be custom resources too. Because budgets and rate limits are shared through Redis rather than held per replica, scaling out never lets a budget be spent twice — and the operator marks an instance with several API replicas and no Redis as not ready. It needs Kubernetes 1.28 or newer, or OpenShift 4; a Helm chart is there if you would rather template than operate.

Rust in the data plane

Built on tokio, hyper and axum with zero-copy streaming paths, shipped as one distroless, non-root binary. No interpreter, no package manager, no Node runtime in the gateway — the admin console is served by the same binary. There is no ML router in the hot path, so routing adds deterministic analysis rather than model inference.

What Wäg is not

Stated plainly so you evaluate it on the right axis, and so nobody books a briefing expecting the wrong product.

• Not an inference server. It does not run models. It routes to the ones you already use, including self-hosted vLLM or Ollama endpoints, and Wäg Edge governs models running on members' computers and in mobile apps.
• Not a model host. No weights, no GPUs, no fine-tuning pipeline.
• Not a vector database. It proxies embeddings calls and caches semantically; it does not store your corpus.
• Not an observability backend. It emits OTEL and Prometheus into whatever you already run.
• Not an API gateway replacement. Kong and Envoy govern HTTP. Wäg governs tokens, models and agent actions. They are complementary layers, and most estates run both.

See the control plane · See the benchmarks