LLM gateway policy and audit
Apply governance policies to the model calls that flow through the LLM gateway, and review what gets logged. Policies let you control which models agents can use, flag unusual usage patterns, and maintain an audit trail for compliance.
Model governance
The LLM gateway routes model calls to Anthropic's API on behalf of your organization. You can restrict which models agents are allowed to use from the Policy tab in LLM Gateway settings.
| Setting | Effect |
|---|---|
| Allowed models | Agents can only request models on the allowlist. Requests for other models are rejected with a clear error. |
| Default model | Requests that don't specify a model are routed to this model. Useful for ensuring cost predictability across agents. |
Coworker Agent harness configuration sets the model at the agent level; the gateway-level allowlist is an outer bound that prevents any agent, including a misconfigured or compromised one, from calling a model outside your policy.
Rules
LLM gateway traffic supports the same rule system used for MCP tool call governance. Rules run on each model request and can flag, block, or route the call based on content or metadata.
Common uses for LLM gateway rules:
- Flag high-token requests: alert when a single request exceeds a token threshold (useful for catching runaway loops).
- Block sensitive content: stop requests that contain credentials or PII before they reach the model.
- Notify on anomalous usage: send a Slack alert when usage spikes above a baseline.
Create and manage rules at app.mintmcp.com/monitor/rules. See Agent Monitor rules for the full rule authoring reference.
Audit logging
Every model call through the LLM gateway is logged with:
| Field | Description |
|---|---|
| Agent / key | Which gateway key made the call, attributed to the agent or developer it was issued for |
| Model | The model requested and the model actually used |
| Tokens | Input and output token counts |
| Timestamp | When the request was made and when it completed |
| Status | Success, blocked by policy, or error |
Logs are available in LLM Gateway → Activity and can be exported for SIEM integration. See SIEM export.
Usage limits
Per-key and per-organization usage limits prevent runaway cost from a misconfigured agent. Configure limits in LLM Gateway → Policy:
| Limit type | Scope | Effect when exceeded |
|---|---|---|
| Daily token budget | Per key | Requests from that key are blocked until the budget resets |
| Request rate limit | Per key | Requests are throttled with a 429 Too Many Requests response |
| Org monthly budget | Organization | All gateway calls are blocked until an admin raises the budget or the month resets |
Permissions
Managing LLM gateway policies requires the LLM gateway manage permission. Members without it can view their own usage but cannot change policy settings or issue keys.
Assign the permission through Roles and permissions.
Next steps
- Access control: issue and revoke gateway keys
- Agent Monitor rules: full rule authoring reference
- SIEM export: export audit logs to your security tooling