Governance & administration

The controls that sit in the data path: guardrails, budgets, API keys, and who can change them. For the concepts, see Budgets & governance. This is where each one lives in the console.

The Governance page

Three tabs, and each card saves on its own.

Guardrails tab

Global kill switch: halt all gateway traffic (every /v1/* request returns 503), with an optional message shown to callers. A banner at the top of the card shows whether the gateway is active or halted.
Request limits: a max tokens per request (requests over it are clamped, not rejected) and a global rate limit shared across all keys.
Privacy & content: require API-key authentication, mask PII in stored logs (with built-in patterns for credit card, SSN, Aadhaar, email, and phone, plus your own regex patterns), and store request & response payloads. Payload capture is off by default and asks for confirmation, because full prompts and responses then live in your database.
Output guardrails: block any model response matching a deny-list of keywords or regexes (fires a 422), and optionally mask PII in the responses returned to callers.
Prompt-injection detection: block user and tool messages that match built-in injection patterns (fires a 400), plus your own custom rules. System prompts are trusted and not checked.

Observability tab

Log retention: how many days request logs are kept (production defaults to 30; 0 means indefinite).
Alerting & webhooks: a webhook URL that receives budget and error-rate alerts, and an error-rate threshold that fires when the rolling one-hour failure rate exceeds it.
Provider health: a live, 24-hour table of per-provider request count, error rate, and latency.
Recent admin events: the latest changes, filterable by area, with a link to the full audit log.

General tab

System information: gateway version, active providers, default model, and routing mode.
Semantic cache: enable similarity-based response caching, set the similarity threshold and TTL, and clear the cache. It needs an OpenAI key for embeddings.
Data export: download the request log and the audit log as CSV.

Budgets

Stop or downgrade spend once a threshold is hit. Spend is measured over a rolling daily or monthly window. Two chips at the top show how many constraints are active and how many are breached right now.

In Add budget constraint, choose a scope (Application or Provider), a value, a period (Daily or Monthly), a dollar limit, and an action:

Action	What happens at the limit
Block	Requests are rejected with a 429, and the message is forwarded to the caller.
Downgrade	Requests keep flowing, but the router switches to the lightest available model until the window resets.
Alert only	No enforcement. The breach shows in the dashboard and the header badge.

For Block and Downgrade you can also set a warn-at % that fires a webhook before the cap is reached. The constraints table shows a spend bar per cap (green, amber past 80%, red when breached), and lets you edit or delete each one. Windows refresh on a 30-second cycle.

Connecting providers & managing models

Provider keys and the model registry live on the Models page (sidebar → Connect → Models), covered step by step under Setting up routing. In short: add a key, Test connection, Discover and import models, and Sync Models to refresh pricing and benchmark scores. Each model can be edited (tier, pricing, context window) or tested individually.

Default model & API keys

The Settings page holds gateway configuration:

Default gateway: the provider and model used when a request sends model: "auto" or names none.
Security: the Require API keys toggle. When on, anonymous gateway calls are rejected.
Gateway API keys: create a key bound to an application (attribution then becomes trusted rather than self-reported), with an optional rate limit, allowed-models list, and expiry. A new key is shown once, so copy it then. Each key can be rotated (the old one stops working immediately) or revoked.

Kill switches

There are two, for different blast radii. The global kill switch (Governance → Guardrails) halts all traffic. The per-application kill switch (the connected/disconnected toggle on the Applications page) rejects one application's traffic and leaves everyone else running.

Audit log

An immutable record of every admin action: rule changes, budget edits, key creation and revocation, and governance updates. Each entry shows the time, the action, the affected entity, a snippet of what changed, and who did it. Export it as CSV from Governance → General → Data export.

Users & access

Who can sign in, and what they can do, depends on how the instance authenticates (ARBR_AUTH_MODE):

Mode	Sign-in
adminkey	A single shared admin key (the `ARBR_ADMIN_KEY` environment variable). Simplest, good for a small team.
oidc	Per-user SSO through your identity provider, with a real session and a per-user audit trail.
trusted-header	Identity asserted by a reverse proxy or Google IAP in front of Arbr.

Under the SSO and trusted-header modes, the Users page lists everyone who has signed in, each with a role: viewer, operator, or administrator. You can change a role inline or disable a user, which revokes only their access. The first administrator is minted with scripts/bootstrap-admin.js. See the deployment guide for the environment variables.