AIGP Provider Registry — Universal AI Model Coverage

PRIVATE AND PROPRIETARY — NOT A PUBLIC RFC. Owned by Kanjani AI Research & Causum. See NOTICE.md.

How Every Provider Is Covered

flowchart TD
    subgraph "OpenAI-Compatible (Proxy Mode)"
        OAI[OpenAI]
        GROK[Grok / xAI]
        MIST[Mistral]
        TOG[Together AI]
        FIRE[Fireworks]
        GROQ[Groq]
        OLLAMA[Ollama / Local]
        VLLM[vLLM]
        DEEP[DeepSeek]
        COHC[Cohere Command-R]
    end

    subgraph "Native SDK (Adapter)"
        BED[AWS Bedrock]
        ANT[Anthropic Direct]
        GCP[Google Vertex / Gemini]
        AZU[Azure OpenAI]
    end

    subgraph "Custom Proxy Handler"
        HUG[Hugging Face Inference]
        COH[Cohere Native]
        AI21[AI21 Labs]
        RPLC[Replicate]
    end

    subgraph "Log Harvest (Webhook/Manifest)"
        SF[Salesforce Einstein]
        MS[Microsoft Copilot]
        SAP[SAP AI Core]
        IBM[IBM watsonx]
        SNOW[ServiceNow AI]
    end

    OAI --> GW[AIGP Gateway<br/>Proxy Mode]
    GROK --> GW
    MIST --> GW
    TOG --> GW
    FIRE --> GW
    GROQ --> GW
    OLLAMA --> GW
    VLLM --> GW
    DEEP --> GW
    COHC --> GW

    BED --> SDK[AIGP SDK<br/>aigp-client]
    ANT --> SDK
    GCP --> SDK
    AZU --> SDK

    HUG --> CUSTOM[AIGP Gateway<br/>Custom Handler]
    COH --> CUSTOM
    AI21 --> CUSTOM
    RPLC --> CUSTOM

    SF --> HARVEST[AIGP Log Harvest<br/>Manifest]
    MS --> HARVEST
    SAP --> HARVEST
    IBM --> HARVEST
    SNOW --> HARVEST

    GW --> GOV[governance-server]
    SDK --> GOV
    CUSTOM --> GOV
    HARVEST --> GOV

Provider Coverage Matrix

Provider	API Style	Integration Method	Effort
OpenAI	OpenAI-compat	Gateway proxy	Zero config
Anthropic	Native	SDK (`aigp-anthropic`) or Gateway	Zero config
AWS Bedrock	AWS SDK	SDK (`GovernedBedrockService`)	Zero config
Google Vertex AI	REST/gRPC	Gateway custom handler	1 file
Azure OpenAI	OpenAI-compat	Gateway proxy	Zero config
Grok (xAI)	OpenAI-compat	Gateway proxy	Zero config
Mistral	OpenAI-compat	Gateway proxy	Zero config
Groq	OpenAI-compat	Gateway proxy	Zero config
Together AI	OpenAI-compat	Gateway proxy	Zero config
Fireworks AI	OpenAI-compat	Gateway proxy	Zero config
DeepSeek	OpenAI-compat	Gateway proxy	Zero config
Cohere	Native	Gateway custom handler	1 file
AI21 Labs	Native	Gateway custom handler	1 file
Replicate	REST	Gateway custom handler	1 file
Hugging Face	REST	Gateway custom handler	1 file
Ollama (local)	OpenAI-compat	Gateway proxy	Zero config
vLLM (local)	OpenAI-compat	Gateway proxy	Zero config
LM Studio	OpenAI-compat	Gateway proxy	Zero config
Salesforce Einstein	Proprietary	Log Harvest manifest	1 YAML
Microsoft Copilot	Graph API	Log Harvest manifest	1 YAML
SAP AI Core	REST	Log Harvest manifest	1 YAML
IBM watsonx	REST	Gateway custom handler	1 file
ServiceNow AI	Proprietary	Log Harvest manifest	1 YAML

Why This Works

Most providers are OpenAI-compatible. The industry converged on the /v1/chat/completions format. Any provider that accepts:

POST /v1/chat/completions
{"model": "...", "messages": [...]}

…is automatically governed by the AIGP Gateway proxy with zero additional code. This covers 15+ providers today.

For native APIs (4-5 providers), we have either:

A dedicated SDK adapter (Bedrock, Anthropic) — already built
A one-file gateway handler (Vertex, Cohere, AI21)

For SaaS platforms (Salesforce, Microsoft, SAP) that don’t expose model APIs:

Log Harvest with a YAML manifest normalizes their audit logs into AIGP RECORDs

Adding a New Provider

If OpenAI-compatible (most common):

# In gateway config — just add the backend:
proxy:
  backends:
    grok:
      url: "https://api.x.ai"
      api_key: "${GROK_API_KEY}"

Done. Zero code.

If native API (rare):

# gateway/proxy/vertex.py — one handler file (~40 lines)
async def proxy_vertex(request, gov_client):
    decision = await gov_client.check(...)
    if decision["decision"] == "DENY": return 403
    response = await call_vertex(request)
    await gov_client.record(...)
    return response

If SaaS (no API access):

manifest_version: "2.0"
vendor: "ServiceNow"
system: "Now Assist"
source:
  type: rest_api
  endpoint: "/api/now/table/sys_audit"
  poll_interval_seconds: 300
field_mapping:
  actor: "user"
  operation: "action"
  timestamp: "sys_created_on"

Summary

Question	Answer
“What about Grok?”	OpenAI-compatible → Gateway proxy, zero config
“What about local models?”	Ollama/vLLM are OpenAI-compatible → Gateway proxy
“What about Salesforce Einstein?”	Log Harvest manifest (1 YAML file)
“What about a provider that doesn’t exist yet?”	If OpenAI-compat → zero work. If native → 1 handler file. If SaaS → 1 manifest.

Provider Classification

Governance intensity scales by where the data goes:

graph LR
    subgraph "Classification by Data Residency"
        LOCAL["🟢 LOCAL<br/>Data never leaves machine"]
        SELF["🔵 SELF-HOSTED<br/>Data stays in your VPC"]
        CLOUD["🟠 CLOUD API<br/>Data sent to vendor"]
        EMBEDDED["🟣 EMBEDDED SaaS<br/>Vendor-managed, no access"]
    end

    LOCAL -->|lightest| G1["RECORD only<br/>(optional, offline-capable)"]
    SELF -->|moderate| G2["CHECK + RECORD"]
    CLOUD -->|full| G3["CHECK + RECORD + TRACE<br/>+ DLP + Consent"]
    EMBEDDED -->|harvest| G4["Log Harvest<br/>(manifest-based)"]

Classification Table

Class	Risk Level	Data Leaves Org?	Governance
`LOCAL`	Low	No (on-device)	Optional RECORD — track usage for cost/audit
`EDGE`	Low	No (on-device, limited)	Best-effort RECORD (may lack connectivity)
`SELF_HOSTED`	Medium	No (your VPC)	CHECK + RECORD — enforce model allowlist, track tokens
`CLOUD_API`	High	Yes (vendor stores)	Full: CHECK + RECORD + TRACE + DLP scan + consent required
`CLOUD_PRIVATE`	Medium	Yes (your VPC via vendor)	CHECK + RECORD + TRACE — vendor infra, your data isolation
`EMBEDDED_SAAS`	High	Yes (vendor-managed)	Log Harvest — no runtime control, observe only
`FINE_TUNED`	Critical	Varies	Full governance + model fingerprint + IP protection

Providers by Class

Class	Providers
`LOCAL`	Ollama, LM Studio, llama.cpp, LocalAI, Jan
`EDGE`	Phi-3 (on-device), Gemma (mobile), TinyLlama, ONNX Runtime
`SELF_HOSTED`	vLLM, TGI, SageMaker endpoint, GKE model serving, Bedrock custom model
`CLOUD_API`	OpenAI, Anthropic, Mistral, Grok, Groq, Together, Fireworks, DeepSeek, Cohere, AI21
`CLOUD_PRIVATE`	Azure OpenAI (private endpoint), Bedrock (VPC), Vertex AI (VPC-SC)
`EMBEDDED_SAAS`	Salesforce Einstein, Microsoft Copilot, ServiceNow Now Assist, SAP AI Core, Notion AI
`FINE_TUNED`	Customer-trained models on any platform

Gateway Configuration with Classification

providers:
  openai:
    class: CLOUD_API
    url: "https://api.openai.com"
    api_key: "${OPENAI_API_KEY}"

  ollama:
    class: LOCAL
    url: "http://localhost:11434"

  bedrock:
    class: CLOUD_PRIVATE
    region: "us-east-1"

  vllm-internal:
    class: SELF_HOSTED
    url: "http://vllm.internal:8000"

  salesforce:
    class: EMBEDDED_SAAS
    harvest_manifest: "manifests/salesforce-einstein.yaml"

governance_by_class:
  LOCAL:
    check: false
    record: true
    trace: false
    dlp: false
    consent_required: false

  SELF_HOSTED:
    check: true
    record: true
    trace: false
    dlp: false
    consent_required: false

  CLOUD_API:
    check: true
    record: true
    trace: true
    dlp: true
    consent_required: true

  CLOUD_PRIVATE:
    check: true
    record: true
    trace: true
    dlp: false
    consent_required: true

  EMBEDDED_SAAS:
    check: false
    record: true  # via harvest
    trace: false
    dlp: false
    consent_required: false

Policy Implications

Policy	LOCAL	SELF_HOSTED	CLOUD_API	EMBEDDED
Pre-invocation CHECK	❌	✅	✅	❌
Post-invocation RECORD	✅ (optional)	✅	✅	✅ (harvest)
Full TRACE (26 stages)	❌	❌	✅	❌
DLP prompt scanning	❌	❌	✅	❌
User consent required	❌	❌	✅	❌
Model allowlist	❌	✅	✅	❌
Token budget enforcement	❌	✅	✅	❌
D-DNA evidence	❌	✅	✅	❌