Three separate stretches
Enterprise AI problems usually sit in one of three places. A product built for one stretch will not solve another.
The model call
Several providers integrated separately, keys spread across people, an invoice that only shows a total, no fallback when a channel fails. This is what a gateway is for: one entry point, multi-model routing, quota by person or department, call logs, and private deployment to keep those logs inside.
The project and the run
Files, context and results scattered across personal accounts; agents that can read and write repositories and business systems without an identity of their own; failures, retries and human takeover with no record; permissions that cannot be withdrawn when a project ends. A gateway cannot see this: it sees calls, not a piece of work from start to acceptance.
The job and the method
Staff do not know how to use it, and similar work starts from scratch each time. That is what workflows, role-split AI teams and reusable templates address — a layer on top of the first two, not a replacement for them.
What each category typically covers
| The problem | AI gateway | Execution governance platform |
|---|---|---|
| Unified access to several models | Yes | Depends on how it is connected; an existing gateway can stay |
| Quota by person or department | Yes | Yes, and attributed to project and task |
| Logging | Yes, per request | Yes, per task, including failures, retries and human takeover |
| Project workspace, files and context | No | Yes |
| Action-level agent permission and approval before a run | No | Yes, where the selected agent supports it |
| Request, approval and revocation of access | Usually not | Yes |
| Handover when people change | No | Yes — a workspace belongs to the project |
| Private deployment | Common | Yes |
The table describes what each category typically covers, not any one vendor's feature list. For an actual selection, check each product's own documentation.
Which layer to start with
- The hardest question is how to split this month's AI invoice, or who holds the keys — start with a gateway.
- The hardest question is who asked the AI to do this, what data it touched and who received the result — you need the governance layer.
- Both, with budget for one: cover the stretch where a mistake can do damage, which is usually permissions and execution records.
- You already run a gateway: keep it. The governance layer manages the capabilities, permissions and records once they are connected and authorised.
How they divide the work when stacked
The gateway keeps routing, quota and call logs. The governance layer holds projects, people, permissions, approval, handover and task-level records, and attributes usage to a person, a project and a model. Both record, at different grain: one request, one piece of work from start to acceptance.
For how the permissions are designed, see designing agent access and audit; for attribution, see managing multi-model usage, quota and cost.
Common questions
We already run an AI gateway. Do we still need a governance platform?
It depends where you are stuck. If invoices and keys are handled and what remains is projects, permissions, approval and handover, that is a layer the gateway does not cover. The gateway can stay.
Can a gateway replace an execution governance platform?
Not fully. A gateway sees individual model calls; it cannot reconstruct a piece of work from request through authorisation to acceptance, and it does not handle project workspaces or handover.
Would running both duplicate the records?
Each records at its own grain: the gateway records requests, the governance layer records tasks, including failures, retries, human takeover and the final deliverable. Reconciliation is more useful per task.
We are a team of fifteen. Which layer do we need?
With a small team and no contact with internal systems, use whichever tool suits. Once several teams share models, AI touches company data, or cost has to be split, work through the order above.
Tell us where you are stuck
Say which question is hardest to answer right now — invoices and keys, or responsibility and handover — and we will scope from there.
Discuss a pilot