Architecture · 10 of 19 · Model and tool plane

Two gates out of the sandbox: one for tools, one for models

Tools and models are governed separately because they fail differently. Tools change the world and are tiered and reversible in git. Models cost money and leak data, so they get an allowlist, a token budget and a caller identity that ties every request to a run.

Two gates out of the sandbox: one for tools, one for models Architecture in which an agent run inside a default-deny sandbox has only two egress paths, to Clearance for tools and to the model proxy for models; Clearance reaches platform tools with tiers and allowlisted third-party MCP servers, while the model proxy holds provider keys and routes to hosted models or to a self-hosted Modelplane inference gateway using the session as the caller identity. SANDBOX · DEFAULT-DENYGOVERNED EGRESSBACKENDSMCPLLMTIEREDALLOWLISTKEY IN PROXYCALLER = RUNAgent runany frameworkClearancetools · policy · auditModel proxyallowlist · budget · caller idPlatform toolsrepos · ArgoCD · Tekton · catalogThird-party MCPallowlisted hosts onlyHosted modelsAnthropic · OpenAISelf-hosted modelsModelplane InferenceGatewayProvider keys live only in the proxy. Nothing in the sandbox holds a credential.LEGENDEgress gateAgent runBackendOptionalGoverned call

Principle honored

Never-persisted credentials. Modelplane's gateway supports per-caller API keys, but a key per run is a persisted secret; its "behind another gateway" mode trusts an x-modelplane-caller header instead.

What changes

  • The model proxy authenticates the run by TokenReview and sets x-modelplane-caller to the session id.
  • The inference gateway is reachable only from the proxy, so nothing else can set that header.
  • Modelplane stamps the caller on its usage records but advertises no usage caps or token metering, so budgets stay in the proxy.

Unverified

Unverified: what Modelplane's usage records contain (tokens, latency, model), and whether they can be joined to task_id. Read a real record before promising cost attribution.

Hangar · Autopilot