Credentials spread across services
Resolve OpenAI credentials server-side from approved secret references instead of returning them through the control plane.
OpenAI integration
Govern OpenAI traffic without rewriting every application.
Point OpenAI-compatible clients at Entrovik, keep provider credentials behind the gateway, and enforce policy before requests reach OpenAI and before responses return.
Why teams act
AI adoption creates a new control surface. Put enforcement in the path.
Entrovik gives security, platform, compliance, and application teams a shared technical boundary without coupling enterprise policy to one provider SDK.
Governance stops at one endpoint
Protect chat completions, Responses API, and embeddings with normalized content, tool, multimodal, model, and size policy inputs.
Tokens can escape before inspection
Choose complete-response buffering or guarded live SSE that evaluates accumulated output before release and falls back safely when a policy requires the full answer.
Enforcement model
Central policy with application-level context.
Every decision can use normalized content plus tenant, identity, team, application, provider, model, stage, and configured policy metadata.
01Compatible ingress
Preserve familiar OpenAI request paths and response shapes for client adoption.
02Guarded live SSE
Choose secure complete-response buffering, policy-evaluated live Chat Completions with holdback, or disabled streaming.
03Tool-call inspection
Normalize function descriptions and tool-call arguments so policies can inspect protected content.
04Usage attribution
Capture input and output token usage and configurable estimated cost by application, user, team, and tenant.
In the request path
One decision lifecycle. Every interaction.
Policies remain modular packages. The core resolves, executes, contains, explains, measures, and audits them.
- 01
Change the application's base URL to the Entrovik ingress and authenticate with an Entrovik API client
- 02
Resolve tenant policy, pipeline, provider, model, cost, and streaming context
- 03
Run request_received and before_provider stages
- 04
Call OpenAI through the guarded provider adapter
- 05
Run response policy before returning JSON, complete-response buffered SSE, or a governed live prefix
Technical FAQ
Questions teams ask before deployment.
Do we need to change the OpenAI SDK?
Usually the integration is a base-URL and credential change for supported OpenAI-compatible calls.
Is stream: true supported?
Yes. Buffered mode is the secure default. Administrators can enable guarded live Chat Completions when every response policy declares incremental safety; otherwise Entrovik falls back to buffering.
Where is the OpenAI API key stored?
Use an environment, Kubernetes, Vault, AWS, Azure, or Google secret reference. It is not returned by the administrative API.
Are tool calls supported?
Normalized tool definitions, tool choices, and tool-call arguments are preserved for policy inspection and provider conversion.
Can Entrovik govern Azure-hosted compatible endpoints?
OpenAI-compatible base URLs are configurable. Validate authentication and wire differences for the exact endpoint during integration.
Put it in front of a real workflow
Turn your AI policy into an enforced decision.
Bring one provider path, one policy requirement, and the architecture your reviewers need to trust.