Topic starter
23/10/2026 12:46 am
TL;DR: Claude Desktop can route Cowork and Code through an Agent Router gateway using one inference key, according to Tetrate, which moves billing, request logs, and model policy into a single enforcement point while avoiding per-user Claude.ai accounts. The governance shift is that desktop AI access now behaves like any other governed NHI path, where visibility and entitlement matter more than the client surface.
Editorial analysis by NHI Mgmt Group, based on content published by Tetrate: “Adding Tetrate Agent Router as a third-party inference gateway in Claude Desktop”.
Key questions
Q: How should teams stop desktop AI clients from bypassing the gateway?
A: Make the gateway the only sanctioned inference path and disable any workflow that lets users authenticate directly to the model provider for enterprise use.
Q: Why does direct sign-in create governance risk for desktop AI usage?
A: Direct sign-in creates a second access path that may be functional but invisible to the gateway.
Q: What breaks when model access is not tied to project entitlement?
A: Users can see or expect models that the project is not actually authorised to call, which leads to failed requests, support churn, and unapproved workarounds.
Practitioner guidance
- Enforce gateway-only desktop AI access Disable or discourage direct Claude.ai sign-in paths where enterprise governance requires request logging and policy enforcement.
- Tie model access to project entitlement Review which models each project can call and narrow the desktop allowlist to the minimum set needed for the team.
- Verify request attribution in logs Send test prompts from each desktop tab and confirm the gateway records request headers, model identity, and key attribution in Request Logs.
Bottom line: Desktop AI becomes governable only when the gateway, not the client, is the enforcement point for model access and request logging.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →