Tyr
Asgard Model Hub
Govern
One entry for model calls
- Agents in SindriAsgard Agents Hub
- Every model call an agent makes goes through Tyr. It counts against that key's quota.
- Internal systems and coding tools
- Internal systems and engineers' coding tools reach the same endpoint, with a key Tyr issued.
- Provider accounts
- Tyr connects to vendors such as Claude, OpenAI, Gemini, Vertex, Kimi and xAI. Applications call a fixed alias. Swapping the model changes a mapping in Tyr, not the code.
- Deployment
- Tyr runs with the Asgard platform or on its own. With the platform, sign-in and permissions come from the platform. On its own, you sign in with OAuth / OIDC and Tyr manages its own permissions.
One call
How Tyr handles a call
- 01
Arrives with a key
Agents, internal systems and coding tools all reach one endpoint. - 02
Identifies the key
Tyr identifies which group holds the key, what it is for and which environment. - 03
Checks the model scope
A model this key is not granted cannot be called. - 04
Checks the quota
In enforce mode, a spent quota blocks the call until the next cycle. - 05
Routes to a vendor
Calls are split per the routing rules. If one vendor has trouble, the call moves elsewhere. - 06
Records the call
Tyr records tokens, latency, success or failure. - 07
Breaks it down
Usage and cost break down by key, group, purpose and model.
Product
Administration
Issue keys
Each key records who holds it, its group, environment and purpose, with the models it may call and an expiry date. Keys in use without registration are flagged as unmanaged, to import or delete.
Set quotas
Each key gets a period and a token ceiling. In enforce mode, calls past the ceiling are blocked until the next period. Used, reserved and remaining are all visible.
See usage
Tokens and requests over 7, 30 or 90 days, coloured by key for each day. Usage breaks down by key, group, purpose and model, for charging to departments and projects.
Audit and protection
Issuing a key, changing a quota and revoking a session each go into a searchable audit log. The model gateway blocks prompt injection, attempts to extract API keys or secrets, intrusion attempts and requests with improper intent.
