Core Concepts

Core Concepts

Nexus manages a catalog of objects that together define how AI traffic is governed. This page defines the ones you meet first. Each is configured in the Control Plane console.

Tenancy and identity

• Organization and Project form the tenant hierarchy. Quotas, virtual keys, and routing rules are scoped to one or both.
• User and IAM Group are the principals that act in the system.
• IAM Policy documents grant permissions, either through group attachment or directly to a principal, using NRN (Nexus Resource Name) resource identifiers.

Upstream connectivity

• Provider is an upstream LLM service such as OpenAI, Anthropic, Gemini, Vertex, Azure, Bedrock, or Cohere.
• Credential holds the encrypted provider API key.
• Model and Model Pricing describe what each provider exposes and how its usage is priced.

Traffic shaping

• Virtual Key is the SDK-layer authentication token. Each virtual key scopes which models the caller may use.
• Routing Rule decides which provider and model serves a request, based on its conditions and the active routing strategy. Seven strategies are available: single, fallback, load-balance, conditional, A/B split, policy, and smart.
• Quota Policy and Quota Override define usage limits per organization, project, virtual key, provider, or model.

Compliance

• Hook Config is one compliance check in the pipeline — for example PII detection, content safety, keyword filtering, classification, rate limiting, an IP allowlist, or a webhook forwarder.
• Rule Pack bundles compliance rules, and Rule Pack Install attaches a rule pack to a hook for a tenant.
• Interception Domain decides which network destinations the Compliance Proxy inspects, passes through, or blocks.

Fleet

• Each endpoint where the Desktop Agent runs registers as a node in the Hub registry.
• Device Group organizes endpoint nodes, and Device Assignment binds an endpoint node to a user.

Observability

• Traffic Event records every request handled by any of the three intercept paths — one row per request — and is the basis for analytics.

See also

• Architecture Overview — how these objects move a request through the system.
• Using the Control Plane — where each object is configured.
• Getting Started — see a virtual key, routing rule, and traffic event in action.