Why not use a declarative switch-route rule for plan mode?

switch-route predicates only do structural existence and small-value equality — they never read the content of a string value, which is what keeps large bodies on disk. The plan-mode marker lives in the message text, so it needs the before-slot script; structural checks (image → vision model) are where switch-route shines.

Can a client still pick Opus by editing its own settings?

No. The ingress gate 403s any model name outside the allowlist, and the catch-all mapping normalizes whatever remains to the sanctioned model. Model choice stops being a client decision the moment the request reaches the gateway.

The script seems to have no effect and logs show no error?

Each script runs in its own QuickJS sandbox with a 64MB heap cap (SCRIPT_MEMORY_LIMIT_MB). On out-of-memory the default log-and-continue mode silently drops all side effects — including useModel — so the routing just doesn't switch. Claude Code's tool definitions consume memory first; raise the limit (a restart is required).

← AI Gateway Use Cases

AdvancedPlatform / AI Eng

Pin the model agents run — plan on one, execute on another

Neutralize client-side model choice, then split plan mode from execution so a strong model plans and a cheap model executes.

What the community actually complains about

"Our devs flip Claude Code to Opus to summarize a changelog," "everyone has a different model in their settings and we can't see who spent what," "we tried a client-side policy, but anyone can just edit it back."

Model choice is a cost decision, not a developer preference — it has to be enforced at the gateway, where the request actually lands.

How GateLLM does it

Three layers, none skippable: the key group's models allowlist (ingress gate) rejects unauthorized model names with 403; a catch-all model mapping from "*" rewrites whatever the client requests to the sanctioned model; and a before-slot script keeps plan mode on the strong model and switches to the execution model on exit.

Bypass requests — like Claude Code's conversation-title generation — carry no plan marker, so they fall through to the cheap execution model. That is exactly the "don't run Opus on a summary" behavior you wanted.

5 levers that actually land

Ingress gate: the key group's models allowlist rejects any unauthorized model name before routing
Catch-all mapping: from "*" → to the sanctioned model normalizes every requested name to one model
Plan/exec split: a before-slot script reads the plan-mode markers and switches routing only after exiting plan
Observable: switched requests get an SW tag in the logs, so every request's real landing model is auditable
Hot-reload: mappings and rules take effect immediately — no restart, no per-developer rollout

Full how-to: plan-mode model switch (docs)

FAQ

Book a Demo View pricing