# Enterprise AI Governance: The Four Questions a CIO Asks - GateLLM

> Who uses which model, what it costs and who pays, whether data left the network, and what a provider change costs: four executive questions answered with shipped mechanisms, not promises.

Canonical: https://www.gatellm.io/enterprise-ai-governance/

## Enterprise AI governance: the four questions a CIO asks

Every executive review of AI spend comes down to four questions. Each answer here points at a shipped mechanism you can verify — not a roadmap item.

Granting model access is easy; governing it is not. The four questions below decide whether an AI programme survives its first audit: who is using which model, what it costs and who pays, whether data left the network, and what a provider change costs in engineering time.

## Who is using which model, and how much?

Every request carries a key, a key group and a model. GateLLM records input, output and cache-hit tokens per request at one-minute granularity, and exposes daily and monthly series per key, group and model. Admission control decides which clients may connect at all, by request header.

- Usage and cost break down by person, key, key group and model — no log reconstruction needed.
- Client admission control gates by User-Agent across global, group and key scopes.
- Request-level records keep the identifier needed to trace one call end to end.

- [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md)
- [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md)

## What does it cost, and who pays for it?

Spend is metered against a rate card you own, not a vendor list price. Pin your negotiated prices, tag calls for chargeback, export per-window reports, and set daily or monthly cost quotas that reject requests when a budget is exhausted. GateLLM adds no token markup on top of provider prices.

- Time-windowed rate-card snapshots keep an old report reproducible.
- Tag-based chargeback turns AI spend into an allocable ledger.
- Daily and monthly quotas return 429 when the cap is hit, so a runaway agent stops at a number you chose.

- [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md)
- [Cost Calculator](https://www.gatellm.io/calculator.md)
- [Cost Comparison Methodology](https://www.gatellm.io/methodology.md)

## Did data leave the network, and can we prove it?

You run the gateway, so prompt and response traffic never passes through us. Under BYOK, provider keys live in gateway memory only. Credentials and PII are detected on the request path and can be logged, masked or blocked per scope, and stored log bodies are redacted at every egress point.

- Requests go only to the model endpoints you configure — including self-hosted vLLM or Ollama upstreams.
- Request logs are off by default; revealing raw content is admin-only and audited.
- SSO via OIDC or SAML plus SCIM provisioning; per-tenant keys and quotas.

- [Compliance & Audit](https://www.gatellm.io/use-cases/compliance-audit.md)
- [Security & Compliance](https://www.gatellm.io/security.md)
- [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md)
- [Self-Host AI Inside Office](https://www.gatellm.io/use-cases/self-hosted-office-ai.md)

## If a provider fails or we change models, how much code changes?

A provider 5xx or timeout is retried on another provider without touching application code. Four chat-protocol families translate in both directions, so a client keeps its own SDK. Model identity is mapped at the gateway — by access key, by header or through a catch-all rule — and capability metadata comes from a registry.

- Cross-provider fallback on 5xx or timeout, with no client change.
- Ingress allowlists and catch-all mappings keep one model name stable while the backend changes.
- Capability metadata loads from a registry, so model drift does not require a release.

- [High Availability](https://www.gatellm.io/use-cases/high-availability.md)
- [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md)
- [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md)

## FAQ

### Do we need a gateway to answer these four questions?

Not necessarily. A small team on one provider can answer two of them from provider dashboards. The other two — a request-level data path you control, and code-free failover across providers — are what usually force a self-hosted component.

### Does "data never leaves the network" mean nothing reaches a provider?

No. Your prompts still go to the model endpoints you choose. The gateway does not operate a relay: traffic goes from your network to those endpoints under your own provider contracts.

### Can we start with one team and add others later?

Yes. Keys, key groups and quotas are additive, while the model catalog and routing rules stay shared — a new team does not need a new deployment.

## Related

- [What Is an LLM Gateway?](https://www.gatellm.io/llm-gateway.md)
- [Cost Comparison Methodology](https://www.gatellm.io/methodology.md)
- [Model Catalog](https://www.gatellm.io/models.md)
- [Compare AI Gateways](https://www.gatellm.io/compare.md)

## Related
- [Home](https://www.gatellm.io/index.md)
- [Pricing](https://www.gatellm.io/pricing.md)
- [Cost Calculator](https://www.gatellm.io/calculator.md)
- [About](https://www.gatellm.io/about.md)
- [Book a Demo](https://www.gatellm.io/demo.md)
- [FAQ](https://www.gatellm.io/faq.md)
- [Compare AI Gateways](https://www.gatellm.io/compare.md)
- [Compare LiteLLM](https://www.gatellm.io/compare/litellm.md)
- [Compare OpenRouter](https://www.gatellm.io/compare/openrouter.md)
- [Compare Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md)
- [Compare Azure API Management](https://www.gatellm.io/compare/azure-apim.md)
- [Compare Apigee](https://www.gatellm.io/compare/apigee.md)
- [Compare Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md)
- [Compare Kong AI Gateway](https://www.gatellm.io/compare/kong.md)
- [Compare Portkey](https://www.gatellm.io/compare/portkey.md)
- [Microsoft 365 Copilot Alternative](https://www.gatellm.io/compare/copilot.md)
- [LiteLLM vs Kong AI Gateway](https://www.gatellm.io/compare/litellm-vs-kong.md)
- [LiteLLM vs OpenRouter](https://www.gatellm.io/compare/litellm-vs-openrouter.md)
- [LiteLLM vs Portkey](https://www.gatellm.io/compare/litellm-vs-portkey.md)
- [Use Cases](https://www.gatellm.io/use-cases.md)
- [Reduce LLM Cost](https://www.gatellm.io/use-cases/reduce-cost.md)
- [High Availability](https://www.gatellm.io/use-cases/high-availability.md)
- [Multi-Tenant Isolation](https://www.gatellm.io/use-cases/multi-tenant.md)
- [Compliance & Audit](https://www.gatellm.io/use-cases/compliance-audit.md)
- [Troubleshooting by Symptom](https://www.gatellm.io/use-cases/troubleshooting.md)
- [Mixed Multi-Vendor Model Stack](https://www.gatellm.io/use-cases/mixed-model-stack.md)
- [Self-Host AI Inside Office](https://www.gatellm.io/use-cases/self-hosted-office-ai.md)
- [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md)
- [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md)
- [MCP Tool Governance](https://www.gatellm.io/use-cases/mcp-tool-governance.md)
- [Web Search for Every Model](https://www.gatellm.io/use-cases/web-search-grounding.md)
- [Multi-Key Rotation & Standby](https://www.gatellm.io/use-cases/multi-key-pooling.md)
- [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md)
- [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md)
- [No Model Choice on the Client](https://www.gatellm.io/use-cases/automatic-model-tiering.md)
- [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md)
- [Office / Microsoft 365 Add-in](https://www.gatellm.io/office-addin.md)
- [Glossary](https://www.gatellm.io/glossary.md)
- [What Is an LLM Gateway?](https://www.gatellm.io/llm-gateway.md)
- [Cost Comparison Methodology](https://www.gatellm.io/methodology.md)
- [Model Catalog](https://www.gatellm.io/models.md)
- [SDK & Framework Integrations](https://www.gatellm.io/integrations.md)
- [AI Coding Agents & Harnesses](https://www.gatellm.io/coding-agents.md)
- [Security & Compliance](https://www.gatellm.io/security.md)
- [Privacy Policy](https://www.gatellm.io/privacy-policy.md)
- [Terms of Service](https://www.gatellm.io/terms.md)
- [Cookie Policy](https://www.gatellm.io/cookies.md)
- [Data Processing Agreement (DPA)](https://www.gatellm.io/dpa.md)
- [Sub-processor List](https://www.gatellm.io/subprocessors.md)
- [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md)
- [Incident Response & Support](https://www.gatellm.io/sla.md)
- [Vulnerability Disclosure Policy](https://www.gatellm.io/vulnerability-disclosure.md)
- [Open Source License Notice](https://www.gatellm.io/open-source-licenses.md)
- [Version Support & Lifecycle (EOL)](https://www.gatellm.io/lifecycle.md)
- [Engineering Blog](https://www.gatellm.io/blog.md)
- [Your Agents Have More Permissions Than Your Employees: Governing MCP Tools at the Gateway](https://www.gatellm.io/blog/mcp-tool-governance.md)
- [The $10k Invoice Problem: Five Ways to Cut LLM Spend Without Dumbing Down Your App](https://www.gatellm.io/blog/reduce-cost.md)
- [Your Vendor's List Price Is Not Your Cost: Applying Real FinOps to Token Spend](https://www.gatellm.io/blog/token-finops.md)
- [llms.txt](https://www.gatellm.io/llms.txt)