Security

This page summarises the security controls in Budget AI for security and compliance reviewers. Day-to-day use is covered in Keys and Providers & Credentials.

Keys

• Generation. Keys are sk-ants- followed by 40 characters drawn uniformly from letters and digits with a cryptographic random source, about 238 bits of entropy.
• Storage. Only a salted SHA-256 hash of the key and its last four characters are stored. The plaintext is shown once, at issue or collection, and is never stored, logged, traced or returned again.
• Lookup. The gateway looks a presented key up by its hash in memory. An unknown key costs one hash and is refused without a database read, and is never traced.
• Scope. A key can call only the model groups it is granted, only until it expires, and only within its rate limits and budgets. Every key has an expiry, set in hours or days and bounded by the project's maximum (365 days by default, configurable up to 3650). Expiry is checked on every request. Short-lived keys for one agent can be minted by API within the same maximum.
• Network confinement. A key can be limited to source networks. An address outside the list, or an address that cannot be determined, is refused before any provider is called. An empty list means unrestricted. On self-hosted deployments the trusted proxy setting must match the network path, or callers could forge their address. See Client addresses behind proxies.
• Order of checks. Block, then expiry, then network, so a blocked key reports key_blocked without revealing anything about the caller's network.
• Delivery. Collection links let developers collect their own key. A link is bound to one email address, needs a verified address or an identity-provider sign-in, works once and expires after 72 hours. The key does not exist until it is collected.
• Rotation. A replacement key keeps the old key's grants, limits, network list and hard budget, and carries the period's spend, so rotation cannot be used to shed a control or reset a cap. The old key's grace window cannot outlive its expiry, and the old key is refused as soon as the window ends.
• Incident response. Blocking a key takes effect on every gateway replica within about a second. Suspend agent blocks every key bound to an agent in one transaction and records who suspended it and when; resuming needs step-up verification. Security & Compliance members can block and unblock keys, and suspend and resume agents, through tenant security without being able to issue keys or change credentials.
• Abuse of withdrawn keys. Refusals for blocked, expired and network-confined keys are traced at most once per minute per key and reason, so a withdrawn key cannot be used to flood a project's traces.

Content inspection

With guardrail checks on, the gateway checks each request's prompt before it reaches the provider, and each non-streamed response before it reaches the caller, with the same policies as AI Guardrails. Checks are off by default and are switched on per project or per key. Each policy is set to fail open or fail closed when the detection service is unavailable.

Provider secrets

• At rest. Secrets are encrypted with AES-256-GCM under the platform's ENCRYPTION_KEY, or stored in AWS Secrets Manager with only a reference in the database. The reference path is derived from the project and credential, never taken as input, and a reference outside its own project is refused without being fetched.
• Never returned. Secrets do not appear in any API response, the UI (beyond the last four characters), logs, traces, audit entries or /metrics.
• Redaction. Logs are redacted by value against the live secrets the gateway holds, by the sk-ants- key prefix, and by sensitive field names, so a secret inside an error message or URL is still masked.
• Base URLs. A provider base URL receives the secret, so URLs pointing at loopback, private, link-local or cloud metadata addresses, or embedding credentials, are refused.
• Rotation and moves read the new value back before switching to it, so a failed write never leaves a credential pointing at a missing secret.
• In memory. While serving, the gateway holds provider secrets in process memory. This is inherent to any proxy. It is narrowed by the workload controls below.

Fail-closed behaviour

• If a gateway replica cannot confirm its configuration is current within 5 seconds, it refuses requests with 503 gateway_config_stale rather than serving with possibly outdated keys, grants or limits.
• If Redis, which holds limits, budgets and reservations, is unavailable, requests are refused and nothing reaches a provider.
• A key whose org unit budget chain cannot be built is refused rather than served without its unit's budget.
• A hard budget refuses a model with no price rather than serving spend it cannot count.
• With guardrail checks set to fail closed, a request that cannot be checked is refused with 503 guardrail_unavailable.
• Turning off Serve gateway traffic for this project, or the organization losing the llm-gateway entitlement, stops every key of the project within a minute at most, usually within a second.

Step-up verification

These actions ask the person to verify their identity again with step-up verification before they take effect:

• issuing a key or creating a collection link;
• rotating a key;
• changing a key's allowed source networks;
• unblocking a key;
• resuming a suspended agent;
• creating, changing, rotating, moving or importing a provider credential.

Every check is made on the server, so it cannot be bypassed by calling the API directly. On a deployment that cannot send verification codes, an explicit confirmation is accepted instead and recorded in the audit log.

Audit logging

Every Budget AI change is written to the audit log in the same database transaction as the change, with who made it and the values before and after:

A collected key records both who issued the link and who collected it, with the collector's address.

Access control

Budget AI uses per-page permission scopes for overview, keys, budgets, models and settings, with a separate incident-response permission for blocking keys. Every Budget AI action also re-checks the plan entitlement, the feature flag and module visibility on the server. See Access control, Members & Roles and Custom Roles.

Data handling

• Prompts and responses are stored on traces like any other trace in the project, subject to the project's data retention.
• Keys in usage-only recording mode store no prompt or response text, and never write to the response cache.
• Caller metadata can never overwrite gateway metadata, so a caller cannot disguise gateway traffic as SDK traffic.
• The response cache is scoped to one model group in one project.

Workload hardening (self-hosted)

The Helm chart runs the gateway as non-root with no privilege escalation, a read-only root filesystem, all Linux capabilities dropped and the RuntimeDefault seccomp profile. /metrics is served only on the admin port, which is not on the Service or ingress. An optional egress network policy limits the gateway to DNS, the platform's data services and listed provider endpoints. With AWS Secrets Manager, use a workload identity scoped to the secret prefix instead of static credentials. See Self-Hosting & Configuration.

Not yet available

Expiry reminders and budget threshold alerts are recorded in the product but not delivered by email or chat. Request-and-approve key issuance is not available. See the Roadmap.