Governance that applies to applications that never opted in
Most AI governance is a document. It describes which models are approved, what data may be sent, and who may spend how much — then depends on every team implementing it in every service, correctly, forever. Governance enforced at the control plane is different in kind: the rule lives in one place, applies in the request path, and produces a record. Teams do not implement it. They inherit it.
What governance actually has to answer
| Question | The usual answer | What the control plane produces |
|---|---|---|
| Who may use which models? | A wiki page and good intentions. | Model allow-lists per key, team and tenant, enforced before invocation. |
| What may this cost? | A monthly invoice surprise. | Stacked budgets across org → team → user → model → key that reject the call before the provider is contacted. |
| What data may leave? | A policy PDF and code review. | Pre-call, mid-stream and post-call scanning with block, mask and redact, and verdicts recorded. |
| What is each agent allowed to do on its own? | Whatever its API key allows, for as long as the key exists. | A tool policy per agent, risky calls held for a named approver, and a run that cannot send data out once it has read something private. |
| What actually happened? | Log archaeology. | Every request, decision, verdict and cost as traces and metrics, in a signed evidence ledger, and in audit packs (Enterprise). |
Policy before spend
A budget that reports is a dashboard. A budget that rejects is a control.
Each request is evaluated against every counter and policy that applies to it before any provider is contacted. The first violation rejects the call, so an overspend is prevented rather than discovered. That single property — enforcement in the request path rather than observation after it — is what separates governance you can demonstrate from governance you can only describe.
What you can hand to an auditor
Per-request records with actor, model, routing reason, verdicts and cost; a signed evidence ledger auditors verify offline; where each prompt was sent, a register of information for DORA outsourcing registers, and content-marking coverage. Enterprise adds the admin trail, audit and agent evidence packs, a read-only auditor role, exit export and the marking itself. Governance stops being a document about what should happen and becomes a record of what did.
The workloads you don't know about
A control plane does not discover all shadow AI by itself. What reaches it is visible: the agent inventory flags callers that behave like agents without being registered, and MCP servers developers run on their own machines when their tools pass through the gateway; Wäg Edge reports local model use on members' devices. A notebook with a personal API key or a SaaS tool with its own LLM feature still never appears. What changes is the economics: once provider credentials are only issued through the control plane, going around it stops being the convenient path. That is a meaningful improvement, and it is not the same as a discovery tool.
One endpoint. Every model. Complete control.
Run it in your own infrastructure
Everything you need to run a control plane in production is Apache-2.0 and stays that way — routing, HA, caching, failover, budgets, policy, MCP, jobs and observability. Self-hosted, no account, no phone-home.
$ docker run -p 4000:4000 <registry>/waeg-gateway:<version>Not a working pull: the images are not public yet. Design partners receive the registry details privately.
Deploy in 5 minutesShape it as a design partner
Wäg is not publicly released yet. We are working with a small cohort of teams running multi-provider AI in production, and serious about governance and sovereignty, to harden the control plane on real workloads.
- Every Enterprise capability included, at no licence cost
- Hands-on migration — we do it with you, including from LiteLLM
- A direct line to the engineers building it, and real influence on what ships next