{ "_comment": "Identity & governance matrix per gateway vendor: SSO / SCIM / RBAC / audit logs, and which pricing tier gates each ('the SSO tax'). Control-plane features only — data-plane auth plugins (APISIX openid-connect, Higress key-auth, etc.) protect proxied APIs, not the gateway's own console, and are deliberately excluded. All claims from primary vendor sources (docs, pricing pages, OSS config files), accessed on the as_of date. 'not documented' = the vendor's docs are silent, NOT a confirmed 'no'. Tier gating moves without announcement — verify against live docs before signing.", "as_of": "2026-08-31", "review_note": "本轮复核 2026-08-31(上一版 2026-07-27)。**这是部分复核,不是全量重验**:实际回查了 7/9 条记录,依据各条自带的 sources 重新取证。结果:1 条已更正、14 条经取证确认不变、1 条取证后仍无法判定。 Cloudflare 一条为本轮自行发现(agent 未报):其 08-05 的 identity-aware 控制使原「非 AI-Gateway 专属」表述失效,已据官方 changelog 更正。", "legend": { "sso": "single sign-on to the gateway's admin/control plane (protocols + IdPs); NOT auth for proxied API traffic", "scim": "automated user/group provisioning + deprovisioning from an IdP directory", "rbac": "roles and permission scoping in the control plane (org/team/workspace/key granularity)", "audit_logs": "logs of administrative actions (who changed what), incl. retention + export path", "tier": "the vendor's own pricing-tier wording for where the feature unlocks", "source": "primary URLs backing the cell, accessed on as_of" }, "vendors": [ { "vendor": "LiteLLM", "type": "self-hosted (OSS + Enterprise license key, same Docker image)", "pricing_tiers": "Open Source (free, self-hosted) / Enterprise (custom pricing, 30-day trial, license key; self-hosted or air-gapped)", "sso": { "value": "Admin UI SSO: Google, Microsoft Entra ID, Okta, generic OIDC, and SAML 2.0", "tier": "Free for up to 5 users (since v1.76.0: 'SSO is now Free for up to 5 users'), then Enterprise ('Beyond that, an enterprise license is required')", "source": [ "https://docs.litellm.ai/docs/proxy/admin_ui_sso", "https://docs.litellm.ai/docs/enterprise" ] }, "scim": { "value": "/scim endpoints provision/update/deprovision users and teams; documented IdPs: Microsoft Entra ID, Okta, Google Workspace, OneLogin, Keycloak, Auth0; SCIM removal also deletes the user's API keys", "tier": "Enterprise — exact wording: 'SCIM support requires a premium license.'", "source": [ "https://docs.litellm.ai/docs/tutorials/scim_litellm" ] }, "rbac": { "value": "Global proxy roles (proxy_admin, proxy_admin_viewer, internal_user) + org/team roles (org_admin, team_admin) + key-level scoping (user / team-service-account / user+team keys)", "tier": "Global roles and basic teams/virtual keys free OSS; org/team roles Enterprise — exact wording: 'Organization/Team specific roles are premium features.'", "source": [ "https://docs.litellm.ai/docs/proxy/access_control", "https://www.litellm.ai/enterprise" ] }, "audit_logs": { "value": "Create/Update/Delete/Regenerate on Keys, Teams, Users, Models; viewable in UI; export via S3 callback (JSON per event); enterprise docs add retention policies", "tier": "Enterprise — exact wording: 'Requires Enterprise License'", "source": [ "https://docs.litellm.ai/docs/proxy/multiple_admins", "https://docs.litellm.ai/docs/enterprise" ] }, "notes": "Enterprise = same Docker image unlocked by license key. OSS→Enterprise auth line in docs: OSS 'API keys', Enterprise 'SSO + SCIM, OIDC/JWT'. The 5-user free-SSO carve-out removes the SSO tax for tiny teams only." }, { "vendor": "Portkey", "type": "OSS gateway (data plane only) + hosted control plane", "pricing_tiers": "Open Source (self-host gateway, free) / Developer (free) / Production ($49/month) / Enterprise (custom)", "sso": { "value": "OIDC and SAML 2.0 on the hosted/enterprise control plane; documented IdPs: Okta, Azure AD, generic OIDC/SAML; JIT-provisions first-time SSO users on verified domains. Not in the OSS gateway", "tier": "Enterprise — pricing page lists 'SSO' only under the Enterprise plan; docs call it 'SSO support for enterprises'", "source": [ "https://portkey.ai/docs/product/enterprise-offering/org-management/sso", "https://portkey.ai/pricing" ] }, "scim": { "value": "User provisioning/deprovisioning/updates + group→workspace provisioning with role mapping; documented IdPs: Azure AD, Okta (Okta SCIM requires a SAML app); verified domains only", "tier": "not documented — docs live under 'Enterprise Offering' but no explicit plan banner, and SCIM is absent from the pricing page's tier lists", "source": [ "https://portkey.ai/docs/product/enterprise-offering/org-management/scim", "https://portkey.ai/docs/product/enterprise-offering/org-management/scim/okta" ] }, "rbac": { "value": "Org roles (Owner/Admin/Member) + workspace roles (Manager/Member) + per-API-key granular permissions across ~9 feature areas; workspace-scoped service-account and user API keys. Not in the OSS gateway", "tier": "Conflicting vendor statements: pricing page puts 'Role-Based Access Control, Service Account API Keys' on Production ($49/mo), while the access-control docs page carries the banner 'This is a Portkey Enterprise plan feature.'", "source": [ "https://portkey.ai/docs/product/enterprise-offering/access-control-management", "https://portkey.ai/docs/product/enterprise-offering/org-management/workspaces", "https://portkey.ai/pricing" ] }, "audit_logs": { "value": "Org-wide audit log of admin actions (timestamp, user, workspace, action, resource, status, client IP+country), 'Indefinite log retention'; export via Admin API GET /v1/audit-logs (JSON, filters, pagination); no bulk file export documented for audit logs specifically", "tier": "Enterprise — exact wording: 'This is a Portkey Enterprise plan feature.'", "source": [ "https://portkey.ai/docs/product/enterprise-offering/audit-logs", "https://portkey.ai/docs/api-reference/admin-api/control-plane/audit-logs/list-audit-logs" ] }, "notes": "The OSS repo is the data-plane gateway only; its README lists no SSO/SCIM/RBAC/audit for OSS ('The enterprise version offers advanced capabilities for org management, governance, security'). All identity/governance requires the hosted or enterprise control plane." }, { "vendor": "Kong", "type": "OSS gateway + Konnect SaaS / Kong Gateway Enterprise", "pricing_tiers": "Konnect: Free Trial (30 days, $0, no card) / Plus / Enterprise — the entry-level tier is a time-limited trial, not a perpetual free plan (re-checked 2026-08-31)", "sso": { "value": "Konnect SSO via OIDC and SAML ('supports any OIDC or SAML-compliant provider'; Okta, Azure AD, Oracle IDCS, Keycloak verified). No admin/control-plane SSO documented for OSS Kong Gateway", "tier": "Enterprise only — pricing FAQ verbatim: 'Advanced features like SSO and Audit Logs are only available with Enterprise'", "source": [ "https://developer.konghq.com/konnect-platform/sso/", "https://konghq.com/pricing" ] }, "scim": { "value": "not documented for Konnect or Kong Gateway — SCIM pages exist only for the separate Insomnia product; Konnect instead maps IdP group claims to teams via OIDC/SAML (not SCIM)", "tier": "n/a for the gateway (not documented); Insomnia SCIM is Insomnia-Enterprise", "source": [ "https://developer.konghq.com/insomnia/scim/", "https://developer.konghq.com/konnect-platform/sso/" ] }, "rbac": { "value": "Konnect: teams + predefined/custom roles scoped org-wide, per resource type, per instance, per region. Self-managed Enterprise: RBAC entity with workspace-, endpoint- and entity-level permissions. Absent from OSS: zero rbac config keys in OSS kong.conf.default; how-to states 'This tutorial requires Kong Gateway Enterprise.'", "tier": "Konnect: from Plus tier (pricing lists 'API platform security - RBAC' under Plus); self-managed: Kong Gateway Enterprise only", "source": [ "https://developer.konghq.com/konnect-platform/teams-and-roles/", "https://developer.konghq.com/gateway/entities/rbac/", "https://konghq.com/pricing", "https://raw.githubusercontent.com/Kong/kong/master/kong.conf.default" ] }, "audit_logs": { "value": "Konnect: org audit logs webhooked to SIEM in ArcSight CEF / JSON / CrowdStrike CPS; retention 7 days then permanently deleted. Self-managed Enterprise: /audit/requests and /audit/objects Admin API endpoints, TTL via audit_log_record_ttl. No audit_log keys in OSS kong.conf.default", "tier": "Konnect: Enterprise only ('Advanced features like SSO and Audit Logs are only available with Enterprise'); self-managed: Enterprise Admin API", "source": [ "https://developer.konghq.com/konnect-platform/audit-logs/", "https://developer.konghq.com/gateway/audit-logs/", "https://konghq.com/pricing" ] }, "notes": "Konnect's 7-day audit retention makes the SIEM webhook effectively mandatory for compliance. Kong's pricing page mixes Konnect and Insomnia tables — the SCIM line item belongs to Insomnia, not the gateway." }, { "vendor": "Apache APISIX / API7", "type": "OSS (Apache APISIX) + enterprise (API7)", "pricing_tiers": "OSS free; API7 Enterprise (annual license by CPU cores); API7 Cloud (Standard / Premium)", "sso": { "value": "OSS: none for administration — Admin API uses a single shared admin key; openid-connect/saml-auth plugins authenticate proxied traffic, not the control plane. API7: Dashboard SSO via OIDC, SAML 2.0, LDAP (Keycloak, Entra ID, Auth0, Okta, Google guides)", "tier": "API7 Enterprise only (listed under 'Enterprise Features'); absent in OSS", "source": [ "https://apisix.apache.org/docs/apisix/admin-api/", "https://docs.api7.ai/api7-gateway/security-and-compliance/sso-dashboard", "https://docs.api7.ai/api7-gateway/enterprise-features/dashboard-sso" ] }, "scim": { "value": "OSS: not documented. API7: 'SCIM provisions and de-provisions user accounts' via SCIM endpoint + token; IdP guides for Okta and Microsoft Entra ID; SCIM-labeled users must be deleted via the IdP. Introduced in API7 Enterprise 3.2.11", "tier": "API7 Enterprise only", "source": [ "https://docs.api7.ai/api7-gateway/security-and-compliance/authenticate/scim", "https://api7.ai/blog/api7-3.2.11-scim-and-sso" ] }, "rbac": { "value": "OSS: none for administration (all-or-nothing admin key; wolf-rbac is data-plane). API7: 'Super Admin is the only built-in role' + custom roles + IAM-style JSON permission policies with allow/deny and permission boundaries; scoping shown at gateway-group and published-service level", "tier": "API7 Enterprise only ('Enterprise Features')", "source": [ "https://apisix.apache.org/docs/apisix/admin-api/", "https://docs.api7.ai/api7-gateway/enterprise-features/organization-and-rbac", "https://docs.api7.ai/enterprise/key-concepts/roles-and-permission-policies/" ] }, "audit_logs": { "value": "OSS: not documented. API7: records logins and all operations (time, operator, event type, resource, IP, source); 'retained for 180 days by default'; immutable with data masking; export in JSON or CSV", "tier": "API7 Enterprise only ('Enterprise Features')", "source": [ "https://apisix.apache.org/sitemap.xml", "https://docs.api7.ai/api7-gateway/enterprise-features/audit-logging" ] }, "notes": "Do not conflate APISIX data-plane auth plugins (openid-connect, saml-auth, wolf-rbac, authz-casbin — they protect proxied APIs) with control-plane identity, which OSS APISIX lacks entirely (single shared admin key)." }, { "vendor": "Higress (OSS)", "type": "self-hosted (Apache-2.0)", "pricing_tiers": "OSS free (no paid tier of the OSS project itself; enterprise version sold as Alibaba Cloud APIG — separate row)", "sso": { "value": "not documented — console auth is a single local administrator account ('You need to initialize the administrator account on your first visit'); console repo lists login-management capabilities as a planned iteration", "tier": "n/a — feature absent at any tier", "source": [ "https://higress.cn/en/docs/latest/user/quickstart/", "https://github.com/higress-group/higress-console" ] }, "scim": { "value": "not documented", "tier": "n/a (OSS free)", "source": [ "https://github.com/higress-group/higress-console", "https://higress.cn/en/docs/latest/user/quickstart/" ] }, "rbac": { "value": "not documented — single admin user model; no multi-user, org/team, or per-key console roles in docs or console repo", "tier": "n/a (OSS free)", "source": [ "https://higress.cn/en/docs/latest/user/quickstart/", "https://github.com/higress-group/higress-console" ] }, "audit_logs": { "value": "not documented for console/admin operations (no audit-log feature or export path found in docs or console repo)", "tier": "n/a (OSS free)", "source": [ "https://github.com/higress-group/higress-console", "https://higress.cn/en/docs/latest/user/quickstart/" ] }, "notes": "Data-plane auth plugins (basic-auth, key-auth, JWT, OIDC) authenticate proxied API traffic, not console operators. 'not documented' reflects vendor silence, not confirmed absence of code." }, { "vendor": "Higress hosted (Alibaba Cloud APIG)", "type": "hosted — Alibaba Cloud Cloud-Native API Gateway / AI Gateway, the commercial version of Higress", "pricing_tiers": "Sold by instance capacity; identity/governance inherited from the Alibaba Cloud account plane (RAM / CloudSSO / ActionTrail), not gateway SKUs", "sso": { "value": "Alibaba Cloud RAM SAML 2.0 SSO at the cloud-account plane: role-based SSO (recommended) and user-based SSO; APIG security docs direct customers to RAM-role SSO", "tier": "No cost or edition restriction documented — available to every Alibaba Cloud account (no SSO tax)", "source": [ "https://www.alibabacloud.com/help/en/ram/user-guide/sso-overview", "https://help.aliyun.com/zh/api-gateway/cloud-native-api-gateway/security-and-compliance/identity-management" ] }, "scim": { "value": "CloudSSO SCIM 2.0 user/group provisioning from external IdPs; documented walkthroughs for Okta, Microsoft Entra ID, Keycloak", "tier": "Account-plane service (CloudSSO), not an APIG SKU feature; no paid-tier gating documented on the cited pages", "source": [ "https://www.alibabacloud.com/help/en/cloudsso/user-guide/enable-or-disable-scim-synchronization", "https://www.alibabacloud.com/help/en/cloudsso/user-guide/synchronize-users-or-groups-in-okta-by-using-scim" ] }, "rbac": { "value": "RAM users, groups, roles with system + custom JSON policies (Effect/Action/Resource/Condition); RAM service code 'apig' with resource-level authorization down to individual gateway resources", "tier": "No tier gating documented — RAM is free account-plane infrastructure", "source": [ "https://help.aliyun.com/zh/api-gateway/cloud-native-api-gateway/security-and-compliance/cloud-native-api-gateway-custom-permission-policy-reference", "https://help.aliyun.com/zh/api-gateway/cloud-native-api-gateway/developer-reference/api-apig-2024-03-27-ram" ] }, "audit_logs": { "value": "ActionTrail records console + OpenAPI management events (incl. console sign-in); API Gateway has a documented audit-event list; delivery to Simple Log Service or OSS buckets; 90-day online query/download", "tier": "90-day management-event retention free per account; delivery/extended storage billed at SLS/OSS rates; not gated by APIG SKU", "source": [ "https://www.alibabacloud.com/help/en/actiontrail/product-overview/what-is-actiontrail", "https://help.aliyun.com/zh/actiontrail/product-overview/audit-events-of-api-gateway" ] }, "notes": "All four capabilities come from the Alibaba Cloud account plane (RAM / CloudSSO / ActionTrail) rather than gateway feature tiers. Caveat: CloudSSO pricing page not fetched; 'free' asserted only where a doc said so." }, { "vendor": "OpenRouter", "type": "hosted", "pricing_tiers": "Free / Pay-as-you-go (5.5% platform fee) / Enterprise (custom agreement)", "sso": { "value": "SAML SSO via Okta, Microsoft Entra ID, Google Workspace, or any custom SAML provider; self-serve setup (DNS domain verification + IdP connection) by org admins", "tier": "Enterprise — docs: 'SSO is available for organizations on Enterprise plans'; pricing lists 'SSO/SAML' under Enterprise only", "source": [ "https://openrouter.ai/docs/guides/features/sso", "https://openrouter.ai/pricing" ] }, "scim": { "value": "'SCIM Group Mappings': sync IdP groups to workspaces for automatic access provisioning; IdP-deactivated users lose org membership and their org-scoped API keys are deactivated (not auto-re-enabled on reactivation)", "tier": "Enterprise (documented inside the Enterprise-gated SSO guide; not a separate pricing line item)", "source": [ "https://openrouter.ai/docs/guides/features/sso" ] }, "rbac": { "value": "Two org-level roles only: Admin (full access) and Member; org admins control per-workspace access; members manage only their own keys, admins can view all org keys; no custom roles documented", "tier": "not documented (organization-management docs state no plan requirement; pricing lists 'Admin Controls' under Enterprise)", "source": [ "https://openrouter.ai/docs/organization-management", "https://openrouter.ai/docs/guides/features/workspaces", "https://openrouter.ai/pricing" ] }, "audit_logs": { "value": "not documented — no admin-action audit log (member/role/key-change events) or SIEM path documented. What exists: usage/activity export as CSV or PDF (filter by period, group by model/key/creator) and Enterprise-page 'Unified Reporting'", "tier": "n/a — no audit log to gate; the activity export carries no stated tier, and 'Unified Reporting' is marketed on the Enterprise page", "source": [ "https://openrouter.ai/docs/guides/administration/activity-export", "https://openrouter.ai/enterprise" ] }, "notes": "Classic SSO-tax shape: SSO+SCIM Enterprise-gated; orgs/workspaces/2-role RBAC appear available below Enterprise. Biggest enterprise gap vs peers: no documented admin-action audit log." }, { "vendor": "Vercel AI Gateway", "type": "hosted (identity inherited from the Vercel team plan)", "pricing_tiers": "Hobby (free) / Pro ($20/user/month) / Enterprise (custom); AI Gateway itself available on all three", "sso": { "value": "SAML SSO at the Vercel team level (AI Gateway inherits team identity); 20+ IdPs (Okta, Auth0, Entra, ADFS, OneLogin, Duo, JumpCloud, PingFederate, Keycloak, ...); SAML enforcement toggle", "tier": "Enterprise included, or Pro via paid add-on at '$300 / month' ('Pro teams will first need to purchase the SAML SSO add-on'); not available on Hobby", "source": [ "https://vercel.com/docs/saml", "https://vercel.com/pricing" ] }, "scim": { "value": "'Directory Sync' (SCIM-style): auto invite/remove team members from the IdP directory (Okta, Google Directory, ...), IdP-group-to-role mapping", "tier": "Enterprise only — 'Directory Sync is only available for Enterprise Teams'; NOT purchasable as a Pro add-on", "source": [ "https://vercel.com/docs/directory-sync", "https://vercel.com/pricing" ] }, "rbac": { "value": "Team roles (Owner, Member, Developer, Security, Billing, Viewer, Contributor) + project-level roles + composable permission groups; no per-AI-Gateway-API-key RBAC documented (gateway keys are team-scoped)", "tier": "Pro = team-level, Enterprise = team + project level (pricing page wording); Hobby has none", "source": [ "https://vercel.com/docs/rbac/access-roles", "https://vercel.com/pricing" ] }, "audit_logs": { "value": "Team audit log (Owner role): CSV export (timestamp, action, actor, IP, user_agent, prev/next state; last-90-day exports) + SIEM streaming (S3, Splunk, Datadog, GCS, HTTP JSON/NDJSON; being replaced by 'Audit Log Drains'); covers team/project/member/env-var events, not AI-Gateway request-level events", "tier": "Enterprise only ('available to customers on enterprise plans')", "source": [ "https://vercel.com/docs/audit-log", "https://vercel.com/pricing" ] }, "notes": "AI Gateway has no gateway-specific identity/governance — all four come from the underlying Vercel team plan. The SSO tax is explicit and priced ($300/mo on Pro); SCIM and audit logs cannot be bought on Pro at any price. Third-party claims of a $150/mo Pro SCIM add-on are contradicted by Vercel's own docs." }, { "vendor": "Cloudflare AI Gateway", "type": "hosted (identity inherited from the Cloudflare account plane)", "pricing_tiers": "Account plans Free / Pro / Business / Enterprise; AI Gateway 'available on all plans' (its own gating uses Workers Free vs Workers Paid)", "sso": { "value": "Dashboard SSO connector enforces SSO to the Cloudflare dashboard (where AI Gateway is managed) with any IdP configured in Cloudflare One; SAML 2.0 explicitly documented (incl. Okta IdP-initiated)", "tier": "All plans, free — exact wording: 'Cloudflare Dashboard SSO is available for free to all plans.' No SSO tax", "source": [ "https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/" ] }, "scim": { "value": "Dashboard SCIM user provisioning via Okta, Microsoft Entra ID, or Authentik", "tier": "Enterprise only — exact wording: 'Cloudflare dashboard SCIM provisioning is only available to Enterprise customers'", "source": [ "https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/" ] }, "rbac": { "value": "Account-scoped roles (70+ predefined), domain-scoped roles (~15), resource-scoped roles (Beta, limited resources); no AI-Gateway-specific role and no per-gateway/per-key RBAC documented", "tier": "Docs state no tier restriction; the launch blog shipped Domain Scoped Roles to Enterprise accounts — current docs do not restate a tier (flagged, not inferred)", "source": [ "https://developers.cloudflare.com/fundamentals/manage-members/roles/", "https://developers.cloudflare.com/fundamentals/manage-members/scope/", "https://blog.cloudflare.com/domain-scoped-roles-early-access" ] }, "audit_logs": { "value": "'Audit Logs are available on all plan types'; 18-month retention; export via dashboard CSV, REST API (GET /accounts/{id}/audit_logs), and Logpush to external storage", "tier": "All plans (view/CSV/API); Logpush export called out for Enterprise ('Enterprise customers can extend this using Logpush')", "source": [ "https://developers.cloudflare.com/fundamentals/account/account-security/review-audit-logs/" ] }, "notes": "Identity was wholly inherited from the Cloudflare account plane until 2026-08-05, when AI Gateway shipped identity-aware controls of its own: the verified Cloudflare Access user ID is written into request metadata as `cf.user_id`, enabling per-user spend limits, per-user log filtering and per-user gateway access policies. Authentication still comes from Access (a separate product), but the per-request attribution and the controls built on it are AI-Gateway-specific. 'User Insights' (cost tracking + p95-baselined anomaly detection) shipped the same day, available to all AI Gateway customers at no additional cost. The one vendor in this matrix shipping dashboard SSO free on every plan. AI Gateway request-log Logpush (Workers Paid) is distinct from account audit logs." } ] }