How Tailscale built a customer-facing model router on AI Gateway
Tailscale tied model access and ephemeral agent sandboxes to network identity, without issuing keys to agents. It is a concrete pattern for combining gateways, access control, and isolated execution.
Aperture gives customers one API for **hundreds of models**, with access granted or revoked through tailnet identity. AI Gateway returns usage and cost per request, while Vercel Sandbox provides ephemeral agent execution without issuing a key to the agent.
Builders should treat routing, identity, retention policy, and execution isolation as one system. The described flow validates identity before work begins, supports global or per-request **zero data retention**, and shuts the sandbox down afterward.
Aperture gives customers one API for **hundreds of models**, with access granted or revoked through tailnet identity. AI Gateway returns usage and cost per request, while Vercel Sandbox provides ephemeral agent execution without issuing a key to the agent. Builders should treat routing, identity, retention policy, and execution isolation as one system. The described flow validates identity before work begins, supports global or per-request **zero data retention**, and shuts the sandbox down afterward. This is a vendor case study rather than an independent security assessment. Tailscale reports moving from prototype to paying customers in **months**, but the material gives no benchmark for isolation, latency, or total cost against competing gateways and sandboxes.
This makes gateway design a security architecture rather than merely a model-selection convenience: identity, per-request retention, cost reporting, credential handling, and sandbox teardown are joined at one boundary. It strengthens external-control and least-privilege guidance with a deployed customer flow, but the vendor case study still leaves isolation strength, latency, cost, and failure behavior unvalidated.