AI Gateway | Model Routing & Inference Boundary
The AI Gateway describes the target inference boundary for SeniorCRE®: one place where model selection, PHI handling, audit logging, and approval gating compose. This page separates what is live today from what is design intent, using the same four-tier proof model the rest of the platform docs use.
PHI boundary — current state, honestly
Today, in-product assistants operate on the canonical operational record inside the tenant boundary, with operator/tenant isolation enforced by PostgreSQL Row-Level Security under a non-owner connection role. The production HIPAA-ready AI path — subprocessor BAAs, redaction/tokenization before any third-party call, and a dedicated AI inference audit log — is explicitly out of current scope and gets scoped separately before it gets a date. No PHI flows to any LLM until those BAAs are in place.
needsApproval pattern
AI-driven reads stream. AI-driven writes propose. The pattern is enforced inside specific clinical and financial assistants today (for example, medication-order proposals and ledger entries route through human approval before they persist). A platform-wide approval middleware that sits in front of every AI write across every assistant is roadmap work, not shipped.
Compliance posture
No completed independent penetration-test report claimed. SeniorCRE does not claim SOC 2 certification or its own SOC 2 report; reports are published only when issued. The AI Gateway controls described as roadmap on this page will land inside that scope as they ship.
Why one Gateway is still the right target
That is the target. This page tells you which of those four properties are enforced today and which are roadmap, so a buyer or auditor can map our claims to evidence without translation.
Frequently asked questions
- Why a Gateway instead of calling the model SDKs directly?
- So that PHI handling, model selection, audit logging, and approval gating are enforced in one place rather than re-implemented per assistant. This is the target architecture; today the gateway path is live for in-product assistants on Gemini 2.5, and the broader controls below are on the roadmap, not shipped.
- Why is Gemini 2.5 the default today?
- Long-context, multimodal input, and price/performance at the volume of inferences the in-product assistants generate. It is the default tier today; per-assistant routing of Claude and GPT is on the roadmap, not enabled in production.
- How is PHI handled today?
- In-product assistants scoped per module operate on the governed operating record inside the tenant boundary. The production HIPAA-vetted AI path — vendor selection, BAA execution, redaction/tokenization, and dedicated audit — is explicitly out of current scope and gets scoped separately before it gets a date. No PHI flows to any LLM until subprocessor BAAs are in place.
- What is needsApproval, and is it live?
- needsApproval is the design pattern: every AI-driven write returns as a proposal that a human in the right role must approve before it persists. The pattern is enforced inside specific clinical and financial assistants today; a platform-wide approval middleware in front of every AI write is roadmap, not shipped.
- Can operators bring their own keys (BYOK)?
- BYOK is a roadmap item for enterprise contracts. It is not available today.
https://seniorcre.com/ai-gateway