How Tailscale built a customer-facing model router on AI Gateway
Source
vercel.com
Author
Eric Dodds
Date
Context
Tailscale uses membership in a private network to control access to AI models through Aperture. In Vercel's customer account, adding or removing a user changes their model access without distributing separate provider keys to that person. Vercel AI Gateway supplies the model-routing layer, while sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition → supplies temporary environments for running agents.
The described AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → workflow starts a sandbox, validates its network identity and routes model requests through Aperture; it does not issue a provider key to the agent. This extends the approach in Aperture's earlier launch coverage: centralize access decisions so people and agents can use approved services without each holding the underlying credentials.
Terms in this piece · Glossary
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
