By Adam Wolf
A governed model call is an LLM request that resolves through an enterprise gateway instead of hitting a provider API directly: authenticated, policy-checked, routed, and metered. The strategic case for that pattern has been made at length. What is usually missing is the mechanical account of what happens, hop by hop, between an application asking for a completion and the tokens coming back. This post walks that path using the capabilities Klique documents and flags at each hop what the mechanism does and does not claim.
The five hops of a governed model call. Identity, policy, and metering are Governance Engine responsibilities; name resolution and endpoint selection happen in the gateway itself.
Hop 1: Who is calling?
The request arrives carrying an identity: a user, a service account, or an agent. Each one is a known principal with scoped credentials the platform issues rather than a secret somebody pasted into a config file.
This is the load-bearing difference from the world the request replaced. When a developer points a tool at a personal API key, two parties go blind at once. The provider sees an anonymous consumer account with no relationship to your enterprise, and your enterprise sees nothing: no record that the call happened, no idea what data went out, no lever to pull when the person leaves.
The contractual half of that problem got its own post in The IP Problem With Personal API Keys. Essentially, Anthropic’s August 2025 consumer terms update lets Free, Pro, and Max users allow their conversations to train the model, with five-year retention when they do, and it explicitly does not apply to Claude for Work, Claude for Government, Claude for Education, or API use. One developer’s account choice decides which terms govern your company’s work.
The operational half is credential sprawl, and the industry’s record is bad. GitGuardian’s State of Secrets Sprawl 2026 counted 28.65 million new hardcoded secrets in public GitHub commits during 2025, up 34% year over year, with AI service secrets reaching 1,275,105, up 81% on the same basis.
Platform-issued credentials attack both dimensions:
- Fewer long-lived secrets scattered through repos and dotfiles
- When one leaks, the blast radius is one principal’s scoped access, revocable centrally the moment the offboarding happens.
An agent should authenticate as itself with its delegation recorded, which is the gateway-side expression of Every Agent Needs an Identity and what makes Hop 5 attributable when the traffic is machine-generated.
Hop 2: Which model does the name resolve to?
The caller asks for a gateway model name, not a URL. In Klique’s LLM Gateway that is the model’s logical name: its public route and the value reported for it in usage.
The indirection sounds like a small convenience and is the load-bearing abstraction of the whole design, the same move DNS made for the network. Applications reference a stable name, and administrators compose what sits behind it: which provider endpoints, which self-hosted deployments, and in what proportions.
When a provider changes pricing, when a new model version ships, or when a self-hosted endpoint comes online to take traffic that used to leave the building, the change happens behind the name. No application is edited, and no agent configuration is touched. The same indirection makes a governed call portable because the name can resolve to a commercial API in a connected deployment and to a model inside the boundary in an air-gapped one.
Hop 3: Which endpoint takes this request?
A gateway model can have one or more upstream endpoints, and the gateway load-balances across them. Each endpoint carries a weight, and requests are distributed according to those weights.
A concrete configuration makes the semantics clear. Suppose the general-chat model is backed by three endpoints while a team builds confidence in a self-hosted deployment:
| Endpoint | Weight | Roughly what share of 100 requests |
|---|---|---|
| Primary commercial API | 70 | 70 |
| Second provider | 20 | 20 |
| Self-hosted deployment | 10 | 10 |
When the self-hosted endpoint proves itself, administrators shift weight toward it, gradually and reversibly, without an application change.
The same mechanism is the lever for cost management at the routing layer: send the bulk of traffic to the economical endpoint and keep a premium one in the mix for the work that warrants it. What weights do not do is choose a model per prompt. An administrator sets the proportion between endpoints that already serve one gateway model, and every request follows it regardless of the prompt.
Hop 4: Is this call inside policy?
Before anything goes upstream, entitlement and budget apply. Access can be restricted to named users and groups, and token quotas are tracked per user and per model, with overrides at the model, user, and group level.
Placement is what makes a quota a control rather than a report. Klique’s gateway evaluates a sliding window for each user and model pair. Once usage passes the configured limit inside that window, further requests for that model from that user are rejected until usage falls back into range. A quota that lives in a dashboard tells you afterward that the budget died.
The industry has paid to learn the difference. One widely shared developer account describes an agent that called the same tool roughly 14,000 times overnight and spent $437 before a rate limiter and a token quota stopped it. The dashboard showed the spike. The quota ended it.
Granularity is the other half of enforcement design. A single organization-wide budget means one runaway consumer exhausts everyone, which is the shared service account failure wearing a FinOps costume. Quotas per user keep humans from draining the entire budget, and quotas per model keep an expensive frontier model from becoming the default for work that a smaller one handles. Because an agent with its own identity is a principal like any other, the same quota machinery applies to it.
One default to know before you deploy: if a model’s allowed user and group lists are left empty, everyone in the workspace can reach it. Access is open until you close it.
Hop 5: What gets recorded?
The gateway meters token consumption and reports it against the gateway model name, and the AI Usage tab of the Admin Dashboard is built on those gateway metrics.
Attribution is what converts raw spend into managed cost. With records per user and per model, finance can run showback and chargeback, platform teams can see which models earn their cost and which are habit, and capacity planners get a demand curve instead of a monthly surprise. Klique’s metering can also feed external billing systems, which is what makes an internal AI-as-a-service offering possible.
The forecast says this discipline stops being optional: Goldman Sachs Research expects token consumption to multiply 24 times between 2026 and 2030, to 120 quadrillion tokens per month.
One measurement subtlety matters in any deployment conversation because where you meter changes what the numbers mean. Gateway-side measurement is the honest default for any per-request accounting you intend to defend in front of finance.
Where the meter sits decides what the number includes. A gateway-side meter covers all four stages of the request, including the queue wait and the gateway’s own work. A meter at the model server counts only the tokens it generated.
What does the whole path add up to?
Read the five hops back to back and they compose into four claims that are the gateway’s value proposition, each backed by a specific documented mechanism rather than an adjective.
| The claim | The mechanism | Where |
|---|---|---|
| Replace personal API keys | Platform-issued, scoped identity on every request | Hop 1 |
| Give people approved models | Logical names, plus access restricted to named users and groups | Hops 2 and 4 |
| Control token budgets | Sliding-window quotas per user and model, enforced in the request path | Hop 4 |
| Attribute consumption and cost | Token metering reported per user and per gateway model name | Hop 5 |
Two limits belong in view. First, the gateway governs the Klique applications and services that route through it, so how much of your traffic it covers is a deployment question. Second, the path crosses two of Klique’s three engines: the AI Engine puts every model behind one gateway, while the Governance Engine supplies the identity, access rules, quotas, and metering the gateway enforces on each request.
That split is the point. A proxy forwards requests. A control plane knows who is asking, what they are allowed, and what it cost.
FAQ
What is a logical model name? In Klique, the gateway model name is the model’s logical name: the public route callers use and the value usage is reported against. The upstream model identifier, the provider, and the endpoints behind it can change without any application change.
How does Klique make weighted load balancing work? In Klique’s LLM Gateway, a gateway model can have several upstream endpoints, each with a weight, and the gateway distributes requests according to those weights. It is an operator-set proportion between endpoints, which is a different thing from per-request selection of the best model for a given prompt.
Where are quotas enforced? In the request path. Klique’s LLM Gateway tracks a sliding window per user and model pair and rejects further requests for that model from that user once the configured limit is passed until usage falls back into range. Quotas can be set gateway-wide and overridden per model, per user, and per group.
Who can reach a model by default? Everyone in the Klique workspace. Access becomes restrictive only once you add users or groups to a model’s allowed lists, so an unconfigured model is open inside the workspace.
What usage data does the Klique gateway produce? Token consumption metered against the gateway model name, surfaced in the AI Usage tab of Klique’s Admin Dashboard, and available to external billing systems for showback and chargeback.
Why should agents have their own gateway budgets? Because agents generate traffic at machine speed. An agent that authenticates as itself is a principal like any other in Klique, so the same quotas apply to it, and a loop burns through its own allocation instead of the team’s.
To trace a governed call through your own gateway, request a Klique demo.
