{
  "schema_version": "1.1",
  "id": "s4:https://vercel.com/blog/how-tailscale-built-a-customer-facing-model-router-on-ai-gateway",
  "slug": "how-tailscale-built-a-customer-facing-model-router-on-ai-gateway-186s3tu",
  "url": "https://feed7.dev/p/how-tailscale-built-a-customer-facing-model-router-on-ai-gateway-186s3tu",
  "title": "How Tailscale built a customer-facing model router on AI Gateway",
  "why_included": "Tailscale tied model access and ephemeral agent sandboxes to network identity, without issuing keys to agents. It is a concrete pattern for combining gateways, access control, and isolated execution.",
  "summary": "Aperture gives customers one API for **hundreds of models**, with access granted or revoked through tailnet identity. AI Gateway returns usage and cost per request, while Vercel Sandbox provides ephemeral agent execution without issuing a key to the agent.",
  "practical_implication": "Builders should treat routing, identity, retention policy, and execution isolation as one system. The described flow validates identity before work begins, supports global or per-request **zero data retention**, and shuts the sandbox down afterward.",
  "agent_context": "Aperture gives customers one API for **hundreds of models**, with access granted or revoked through tailnet identity. AI Gateway returns usage and cost per request, while Vercel Sandbox provides ephemeral agent execution without issuing a key to the agent.\n\nBuilders should treat routing, identity, retention policy, and execution isolation as one system. The described flow validates identity before work begins, supports global or per-request **zero data retention**, and shuts the sandbox down afterward.\n\nThis is a vendor case study rather than an independent security assessment. Tailscale reports moving from prototype to paying customers in **months**, but the material gives no benchmark for isolation, latency, or total cost against competing gateways and sandboxes.",
  "source": {
    "name": "Vercel",
    "url": "https://vercel.com/blog/how-tailscale-built-a-customer-facing-model-router-on-ai-gateway",
    "published_at": "2026-09-11T04:00:00.000Z"
  },
  "source_class": "blog_post",
  "content_type": "Engineering Post",
  "layer": "infra",
  "domains": [
    "security",
    "coding"
  ],
  "topics": [
    "gateways",
    "sandboxing",
    "agent-reliability"
  ],
  "verification": {
    "status": "official_source",
    "label": "Official Source",
    "method": "source_feed",
    "verified_at": null
  },
  "uncertainty": [
    "This is a vendor case study rather than an independent security assessment. Tailscale reports moving from prototype to paying customers in **months**, but the material gives no benchmark for isolation, latency, or total cost against competing gateways and sandboxes."
  ],
  "connected_context": {
    "meaning": "This makes gateway design a security architecture rather than merely a model-selection convenience: identity, per-request retention, cost reporting, credential handling, and sandbox teardown are joined at one boundary. It strengthens external-control and least-privilege guidance with a deployed customer flow, but the vendor case study still leaves isolation strength, latency, cost, and failure behavior unvalidated.",
    "corpus_size": 757,
    "generated_at": "2026-09-12T10:05:03.903Z",
    "connections": [
      {
        "title": "Security Firewall for Agents — Ryan Dahl, Deno",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=MkRYPFIMCSA",
        "feed7_url": "https://feed7.dev/p/security-firewall-for-agents-ryan-dahl-deno-12bkfg3",
        "reason": "Deno reinforces the principle that credentials and policy must remain outside an untrusted agent; Aperture applies that principle by validating identity and withholding model keys from sandboxed execution."
      },
      {
        "title": "Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, Docker",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=zaGyGgLW3SM",
        "feed7_url": "https://feed7.dev/p/unlock-agent-autonomy-the-runtime-for-ai-native-systems-tushar-jain-dock-0wg72se",
        "reason": "Docker’s task-scoped capability model supplies the broader least-privilege rationale for Aperture’s identity-gated access and ephemeral execution, while Aperture does not claim Docker’s intent-matching layer."
      },
      {
        "title": "Claude Fable 5.1 now available on AI Gateway",
        "source_name": "Vercel",
        "source_url": "https://vercel.com/changelog/claude-fable-5-1-now-available-on-ai-gateway",
        "feed7_url": "https://feed7.dev/p/claude-fable-5-1-now-available-on-ai-gateway-05yshpy",
        "reason": "Fable’s mandatory retention shows why Aperture’s global or per-request zero-data-retention policy must constrain route eligibility rather than be treated as a gateway-wide assumption."
      },
      {
        "title": "From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI",
        "source_name": "YouTube",
        "source_url": "https://www.youtube.com/watch?v=OqM67QG_Ikk",
        "feed7_url": "https://feed7.dev/p/from-fork-to-fleet-designing-an-agent-sandbox-cloud-abhishek-bhardwaj-op-0np9ki3",
        "reason": "The sandbox-cloud design identifies stronger isolation, persistence, and recovery properties that Aperture’s ephemeral sandbox flow does not benchmark or specify."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-09-11T04:00:00.000Z",
  "modified_at": "2026-09-11T04:00:00.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/how-tailscale-built-a-customer-facing-model-router-on-ai-gateway-186s3tu",
    "json": "https://feed7.dev/p/how-tailscale-built-a-customer-facing-model-router-on-ai-gateway-186s3tu.json",
    "markdown": "https://feed7.dev/p/how-tailscale-built-a-customer-facing-model-router-on-ai-gateway-186s3tu.md"
  }
}