Skip to main content

Governance and Access Control

Taimoe separates management authorization, runtime limits, content controls, and audit evidence. These mechanisms complement each other; enabling one does not imply the others are active.

Governance layers and the direct-provider bypass boundary

Identity and RBAC​

Users authenticate with password or configured enterprise SSO. Authorization is represented by Role Bindings:

Principal + Role + Resource scope

Scopes include platform, Organization, Team, and selected resource types such as Agent. Permissions inherited from a broader scope can authorize access to a child resource. Organization-scoped API checks prevent a user from changing the route or UI selector to read another tenant's data.

Virtual Key authorization​

A Virtual Key authenticates model traffic rather than console users. It belongs to a Team and can be checked against the requested model alias. Deactivation revokes subsequent Gateway use without changing Provider credentials.

Limits and budgets​

The current Gateway enforces multiple windows at both Virtual Key and Team scope:

  • requests per minute;
  • tokens per minute;
  • tokens per day;
  • tokens per month;
  • Team spending budget.

A limit value of 0 means unlimited. Rejections are correlated with a request ID and can be recorded in Gateway audit data.

Guardrails​

Guardrails evaluate AI content or policy conditions. Model Armor integration and governance policy resources exist, but enforcement is path-dependent. A configured policy should not be assumed to cover direct provider calls or every non-Gateway execution path.

Upstream retries do not rerun the logical request's governance checks. This prevents a transient provider failure from consuming governance limits as though the user submitted multiple requests.

Audit evidence​

Taimoe maintains two related audit paths:

  • Control-plane audit records administrative changes. PostgreSQL is the authoritative transactionally written record; BigQuery receives a query-oriented mirror.
  • Gateway audit records model requests, limits, routing outcomes, token/cost data, errors, and retry summaries in BigQuery.

Audit availability does not replace provider-side cloud audit logs. Provider IAM, network, Secret Manager, and cloud audit controls remain necessary for credentials and direct-access paths outside Taimoe.

Current status​

Organization-scoped access, Role Bindings, Virtual Key checks, multi-window limits, budgets, administrative audit, and Gateway audit are available. Content-policy coverage is partial and must be evaluated against the exact request path being deployed.