Enterprise AI teams rarely want the same transport path for every workload. Some requests need centralized redaction, budgets, and audit. Others need to stay inside an AWS account or a private network. Policate treats that as an operating decision, not a provider lock-in decision.
Choose the data path that is ready for your controls
In Direct mode, the binary refreshes a hash-verified, secret-free runtime bundle containing approved models, managed tools, context controls, role selectors, fallback chains, and policy context. Requests then go directly from the binary to the company provider account or local endpoint.
This keeps provider traffic and credentials inside the company environment while preserving the same dashboard, onboarding, managed startup sync, and developer workflow.
The same binary, two execution boundaries
decision pathGateway mode adds authoritative enforcement
Gateway mode inserts one governed hop. The Policate gateway authenticates the request, evaluates the active policy, scores eligible models, checks budgets and rate limits, applies response redaction, can serve an exact-cache hit, isolates provider credentials, and records the resulting trace.
The trade-off is explicit: this is the path for authoritative central enforcement and complete server-side request evidence, but provider traffic passes through Policate before reaching the company provider.
Start direct, add the Gateway when the control requires the path
New workspaces start in Gateway mode so the first request is centrally enforceable. Choose Direct after the signed runtime contract is deployed when hard central budgets, response redaction, shared exact cache, isolated provider credentials, or authoritative request-level audit are not the request-path requirement. Both modes share the same dashboard, onboarding, presets, managed tools, context controls, and startup sync, so changing transport does not mean rebuilding the developer workflow.