Agent Identity Broker · AI Control Plane
Every model call — authenticated, authorized, routed, metered, logged.
Neptic is the choke point every AI agent passes through. Agents get short-lived, task-scoped credentials chained back to the human who started the work — never a provider key. Every turn is classified, authorized, routed to the cheapest approved model that can actually do the work, cost-capped, DLP-scanned, and sealed into a tamper-evident ledger.
Built for regulated and financial institutions.
Single-tenant in your VPC · on-prem · multi-tenant SaaS · SSO via Microsoft Entra ID
Your side
Neptic — the only route through
- Identity. Task-scoped credentials on a human-rooted chain.
- Policy. One deny-by-default decision per turn.
- Routing & spend. The cheapest approved model that fits, reserved before the call.
- Evidence. Every turn sealed, in full, no sampling.
Models
What it is
An identity layer designed for agents, and the control plane that comes with it.
Because every model call already passes through us for credentials, it costs almost nothing more to also authorize the model, route it, meter it, cap it, scan it, and log it immutably. Four faces of one object.
Human-rooted identity
A credential is minted for the task at hand, expires with it, and carries the nested human → agent → sub-agent chain that produced it. The human signs the root; the leaves are minted automatically. There is no human in the hot path — attribution and approval are different mechanisms, and only the first one has to scale.
Role-based access
Who may call which model is a policy, evaluated on every single turn rather than once at session start. Model access, data-class routing and the spend cap are one authorization decision, not three separate meters that can disagree. Deny by default.
Provable data sovereignty
Every prompt is classified before it is routed — PII, PCI, PHI, MNPI, internal, public — and re-classified every turn, because a tool result or a retrieval can inject sensitive data mid-conversation. Where a class may go is your decision, recorded against the agreement you actually hold with that provider, and the classification, the route and the policy that allowed it all land in the ledger.
The cheapest model that can do the job
Which model answers is a decision taken per turn, not a default someone set once. A six-layer router narrows a candidate set that identity and data class have already fixed — so it can make a turn cheaper and cannot make it broader. Every choice is written down and replayable, which is the part that makes a cost saving survive an audit. Routing & cost.
The problem
Agents authenticate the way background scripts did in 2015.
Long-lived, over-permissioned, unattributable API keys sitting in config files and agent memory. That model was already the leading cause of breaches before the software started improvising. Agents make it worse: their behaviour is dynamic, they act on behalf of humans, they delegate to sub-agents, and they hold secrets badly — a key in a context window is exposed to prompt injection.
The service-account model
- One static key per agent, copied into config and read into memory.
- Permissions granted once, covering everything the agent might ever need.
- "Who ran this?" answers with the name of a shared account.
- Model traffic leaves the network with no record of what was sent, or why it was allowed.
- Spend is discovered on the invoice.
The broker model
- Credentials minted per task, scoped to that task, and dead when it ends.
- Authorization re-evaluated on every turn, against the request in front of it.
- The agent never holds the provider key — the real key is injected at the edge.
- Every action traceable through the chain to the human who started the work.
- Spend reserved before the provider is called, and capped per user.
How it works
One request. Ten decisions. All of them recorded.
Every model call — external provider or self-hosted — traverses the same Rust data plane, in this order. Policy is held in memory on the pod, so the hot path makes no call out to a control plane to ask.
authn
The caller is authenticated, and the request carries the nested actor chain — human, agent, sub-agent — rather than a bearer token that says nothing about who is behind it.
classify
The prompt is tagged with a data class and a confidence. Every turn, not once per conversation: retrieval and tool results inject new material mid-flight.
authz
One deny-by-default policy decision covering the model, the data class and the budget together. Not three checks that can each pass while the combination should have failed.
route
An explainable six-layer router narrows an already-approved candidate set. Deterministic policy outranks the model-based layers, and every choice writes a Routing Decision Record.
budget reserve
Spend is reserved atomically before anything is sent. Over the cap returns a refusal with no provider call made and nothing to bill.
dlp in
Input rails run on what is about to leave your network — secrets dropped irreversibly, sensitive fields tokenized so the record still has its shape.
proxy
The call goes out with the real provider key, injected here. The agent has never seen it, and has no network route to the provider that avoids this hop.
dlp out
Output rails run on the response before the agent receives it, because the model is a semi-trusted party too.
meter reconcile
The reservation is settled against what the provider actually reported, so the spend figure is the real one rather than an estimate.
emit audit
The turn is sealed into the ledger — prompt, decisions, tokens, cost, outcome — and chained to the record before it.
Two properties fall out of the order. A refusal short-circuits before the provider call, so a denied turn costs nothing and sends nothing. And if the audit write cannot complete, the turn fails closed — under a regulated posture, a call nobody can prove happened is worse than a call that did not happen.
Routing & cost
Routing decides the bill. The record says why.
Stage 04 is the only stage that changes what a turn costs before the turn happens. Inside a single vendor's current line-up the price range is a multiple, not a margin — so which model answers is a spending decision, taken per turn, and it belongs under the same governance as every other decision here.
The spread
Published list prices, one vendor at a time. Each pair is that vendor's own current generation, so the ratio is a choice a buyer can actually make today.
Anthropic
| Model | Input | Output |
|---|---|---|
| Claude Opus 5 | $5.00 | $25.00 |
| Claude Haiku 4.5 | $1.00 | $5.00 |
5× on input, 5× on output.
OpenAI
| Model | Input | Output |
|---|---|---|
| gpt-5.6-sol | $5.00 | $30.00 |
| gpt-5.4-nano | $0.20 | $1.25 |
25× on input, 24× on output.
| Model | Input | Output |
|---|---|---|
| Gemini 3.1 Pro Preview | $2.00 | $12.00 |
| Gemini 3.1 Flash-Lite | $0.25 | $1.50 |
8× on input, 8× on output.
List prices published by each provider and current as of August 2026: Anthropic (platform.claude.com), OpenAI (developers.openai.com), Google Gemini API (ai.google.dev). Prices change without notice. Gemini 3.1 Pro Preview is priced at this rate for prompts up to 200k tokens. Every ratio above is within one vendor's own current generation — a ratio taken across vendors, or against a model that has been retired, reaches a bigger number and means nothing, so none is shown.
What the published research measures
Query routing has a literature. These are other people's results, on other people's traffic, credited to the people who measured them.
-
3.66×
RouteLLM reports a 3.66× cost saving on MT-Bench while retaining 95% of GPT-4's quality — equivalently, 72.7% less spend for the same benchmark result.
Ong et al., "RouteLLM: Learning to Route LLMs with Preference Data." UC Berkeley · LMSYS · Anyscale. ICLR 2025, arXiv:2406.18665. The same paper measures 1.41× on MMLU at 92% of quality and 1.49× on GSM8K at 87% — the saving and the quality retained both move with the task, which is why one headline figure is not a forecast for your workload.
-
40%
Hybrid LLM reports up to 40% fewer calls to the large model, with no drop in response quality.
Ding et al., "Hybrid LLM: Cost-Efficient and Quality-Aware Query Routing." Microsoft Research · University of British Columbia. ICLR 2024, arXiv:2404.14618. That figure counts calls, not money. What it is worth depends entirely on the price gap between the two models it routes between — which is the table above.
-
43.9%
AWS reports a 43.9% cost reduction while maintaining quality parity with the strongest model in the Claude family.
"Intelligent Prompt Routing." AWS AI, arXiv:2509.06274 (2025). A vendor-authored preprint about that vendor's own product, reported here as what AWS states rather than as an independent result. It is also one of the few figures in this area taken from a production system instead of a benchmark, which is why it is worth quoting at all.
None of those are our numbers, and we will not quote you one. Every figure above was measured by somebody else, on their traffic, with their models — which is exactly why each is credited instead of being presented as a result of ours. What Neptic commits to is the method, not a percentage: an offline evaluation over a sample of your own traffic, replayed against candidate routing policies and reported as cost against quality, so the number you act on was measured on your workload. There is no guaranteed savings floor here and there never will be. Savings move with the task mix, and a vendor who quotes you a figure before seeing your traffic is quoting a benchmark.
How the choice is narrowed
Six layers, in this order. Each one only narrows a candidate set that the first layer already fixed, so the router can make a turn cheaper and cannot make it broader. Deterministic layers outrank the model-based ones, always.
- L0
eligibility
Identity gives the allowed roster; the data class and the region give the allowed providers. Everything else is already excluded before any scoring happens.
- L1
manual override
A permitted operator may name a model. The pick has to be inside the approved set and inside the budget, and who overrode what — and what it cost extra — is recorded.
- L2
deterministic policy
Human-authored, versioned rules force or restrict the candidate set. A rule you wrote beats a score a model produced, which is what makes the behaviour predictable enough to sign off.
- L3
cheap pre-call signals
Token count, context length, modality, whether tools are defined. These are hard constraints rather than guesses: tool definitions restrict to tool-capable models, and a context-window floor removes any model whose window is smaller than the input. The cheap model is only a candidate when it can actually do the job.
- L4
small local ML router
A task and complexity classifier scores what is left, and the routing mode — Balanced by default, or Cost, or Quality, set per tenant or per workload — decides where on the cost/quality/latency frontier you want to sit.
- L5
optional cascade
Opt-in: try the cheap candidate, escalate on a confidence gate — with a cap on how far it can escalate, because an uncapped cascade is a way to spend more than the direct call would have.
Why this is not just a cheaper default
Routing to a smaller model is table stakes and everyone claims it. These four properties are what make it safe to switch on in a regulated environment.
Nothing routes outside what a human approved
L0 fixes the candidate set from identity and data class, and no later layer can add to it. That holds on the bad path too: a retry after a 429, a timeout or an upstream 5xx takes the next model in the fallback chain, inside the same approved set. Fallback never fails up. A router that quietly escalates to a bigger model when the cheap one errors turns a saving into a bill, and does it on the worst day.
Every choice writes a Routing Decision Record
One immutable record per turn: the input features, the candidate set, the scores and the threshold they were judged against, the policy that matched, the model chosen, the fallback chain, any override, and estimated cost against actual. It also carries the router version, the policy config, the roster and the seed — enough to replay the decision and get the same answer. A saving you cannot explain to an auditor is a liability, not a saving.
The router is small, local and versioned
It runs beside the data plane and is never a remote crowd signal, so the decision is deterministic, adds no third-party hop to the hot path, and no prompt leaves the region to be classified. It is pinned and versioned, so a decision made last quarter replays against the router that made it. If the router itself fails, the turn falls safe to a configured default model and is logged as degraded — it is not a single point of failure.
Routing is an attack surface, and is treated as one
A caller who can steer the router can force the most expensive model, or the least-guarded one, and an unbounded cascade is a denial-of-wallet. So: per-identity routing-distribution monitoring, rate limits, per-tenant budget caps, circuit breakers and a maximum-escalation cap. Raw router scores are never returned to the caller, because a score is a gradient to climb.
One request, concretely
A single request on a developer machine, on 7 August 2026, with a deliberately trivial prompt chosen because the answer plainly does not need a frontier model. It is here to show how the substitution is recorded. It is one request, and it is not a savings figure.
- Model the caller asked for
- claude-fable-5
- Prompt
- "what time is it"
- Model that served it
- qwen3-9b-vpc — self-hosted, in the same VPC
- Cost recorded for the turn
- $0.000101
- Same turn, at the requested model's own rates
- $0.001198
Measured against an on-premise vLLM pair through a local listener, not against a production tenant. Both figures are for that one turn.
The response and the sealed record both name qwen3-9b-vpc as the model that answered and claude-fable-5 as the model that was asked for, along with the reason the substitution happened. The requested id never quietly becomes the served one — which is what makes a cost line auditable rather than merely low. A named model the caller is not permitted to use is refused outright rather than substituted, because silently answering a forbidden request with a different model is a policy failure wearing a discount.
Three outcomes
A refusal is not an error.
Most gateways report two outcomes: success and error. That collapses two completely different facts — the control plane refusing a call, and something breaking. An operator who cannot tell them apart rewrites a working policy while the real fault stays broken. Neptic reports three, everywhere, in colour and in words.
The turn completed. The record names the model that actually answered — including when a router or a dated snapshot resolved to a different build than the one requested, which anyone auditing a regulated turn is entitled to know.
The control plane said no — outside a role, over a cap, a payload too large, a data class that may not go where it was headed. This is the product working, so it is amber and never red, and the reason is stated on the page rather than buried in a JSON dump behind a toggle.
Something broke — an upstream provider error, or the fail-closed stop that happens when the audit write itself cannot complete. This is the one that needs a human, and it is the only one wearing red.
Each outcome is classified from the turn's own status code, never from a generic "error" flag — a refused turn carries that flag too, which is exactly how a working policy gets blamed for a broken provider. An unrecognized code is treated as a failure, because "look at this" is the safe default.
The ledger
Evidence, not logs.
Full fidelity, no sampling, every turn. The schema is anchored on the OpenTelemetry GenAI semantic conventions, so it is a superset of what your observability stack already understands rather than a private format.
What a turn record holds
- who, and when
- the full prompt, the system instructions, and the sampling parameters actually sent
- input, reasoning and output tokens; cache reads
- the model and provider that served it
- every tool call, its arguments and its result
- latency, including time to first chunk
- cost, with the breakdown that produced it
- the routing decision and every policy decision
- the outcome — served, refused or failed
Why it holds up
And it can still be erased. GDPR erasure is done by crypto-shredding: the subject's keys are destroyed while the ciphertext and every hash stay exactly where they were. One erasure removes a person's conversations and their attribution, and the chain still verifies — which is the resolution to the standing conflict between a right to be forgotten and a duty to retain.
Deployment & posture
It runs where your data is allowed to be.
The data plane and its logs stay in-region. Nothing about the architecture requires your prompts to leave your own network for us to see them, because we do not need to see them.
Where it runs
Single-tenant inside your VPC, on-prem or air-gapped on Kubernetes, or multi-tenant SaaS with org → team → user isolation. Same enforcement pipeline in every topology.
Keys and retention
Bring your own key or use a customer-managed key. Zero-data-retention terms with providers, and no static, non-expiring credential anywhere in the system — including ours: console sessions and service-to-service auth are time-boxed too.
Egress that cannot be talked around
Agents get no default route to any provider — the proxy is the only path, enforced at the network layer rather than by an environment variable a prompt injection can unset, and pointed at an allowlisted set. An identity broker that can be bypassed at the network layer is not zero trust.
Operators sign in with your directory
Microsoft Entra ID over OpenID Connect. Your Entra app roles map to Neptic roles, so who can change a policy, a cap or a provider is governed by the directory you already run — and every change is itself change-controlled.
Designed to satisfy, and to help you satisfy:
No certification is claimed on this page — those are roadmap milestones, and a vendor that implies otherwise is the wrong vendor for a regulated buyer. What is claimed is the evidence: a per-turn record you can hand to an auditor, and a chain that says whether it has been touched.
Get started
See it decide.
Sign in and open the Request Simulator: send a prompt through the real pipeline and watch it get classified, authorized, routed, capped and recorded — including the ones it refuses, which are the interesting ones.
Sign-in is through your own Microsoft Entra directory. Setting up an organization takes a workspace name and your Entra app registration.