ToolsSeptember 11, 2026via Vercel Blog
How Tailscale built a customer-facing model router on AI Gateway
Why it matters
A practitioner deploying agents at scale needs to route model requests, enforce access controls, and isolate execution — Tailscale's Aperture shows the engineering leverage of picking proven infrastructure (AI Gateway + Sandbox) over building custom. The playbook: delegate the complex plumbing (provider endpoints, cost tracking, ZDR compliance, sandbox security), focus on the network identity layer that is your defensible moat.
Key signals
- Tailscale shipped Aperture (customer-facing model router + agent sandbox) from prototype to paying customers in months
- Built on Vercel AI Gateway (hundreds of models via one API, cost/usage per request, ZDR compliance logic handled) + Vercel Sandbox (isolated agent execution with identity controls)
- Model routing complexity underestimated: 'endpoints are not the same'; providers don't standardize cost reporting, ZDR flags, or response schemas
- Zero cost markup: Tailscale customers pay direct rates, no token markup, including on customer-owned keys
- Agent security mitigated via isolated sandbox + tailnet identity (no API keys issued to agents; sandbox spins up, connects via Tailscale identity, shuts down)
- ZDR (zero data retention) is a moving target across providers; AI Gateway abstracts this logic away
- Tailscale internally migrated from separate provider APIs to AI Gateway via Aperture with zero interruption; now using same migration as playbook for enterprise customers
- Aperture roadmap: time-to-first-app (sign up → run prompt → build app → share) in ≤10 minutes
- Aperture routes hundreds of AI models through tailnet identity (no separate API keys per user/tool)
- Built on Vercel AI Gateway + Vercel Sandbox; went prototype to paying customers in months
- ZDR (zero data retention) compliance automated by AI Gateway; Tailscale didn't have to maintain provider compliance matrix
- Agent execution runs in isolated sandbox with identity + access controls baked in — described as solving the 'lethal trifecta' of agents reading private data, acting on it, and reaching public internet
- AI Gateway returns cost + usage per request; Tailscale customers pay direct rates, no markup
- Tailscale internally migrated from multiple provider API accounts to single AI Gateway integration with zero employee-facing downtime
- Model routing complexity initially underestimated ('deceptively simple'); even basic features like including cost in response are non-standard across providers
- Aperture now ships chat UI, MCP connectors, ephemeral sandbox nodes; next goal: 'time to first app' (signup → prompt → app → share in ≤10 min)
The hook
Tailscale moved from months of routing plumbing to paying customers in weeks by building Aperture on Vercel's AI Gateway and Sandbox — a case study in outsourcing the hard infrastructure so you can own the product.
Tailscale on Vercel
Hundreds of AI models shipped to customers in-product
Model access granted and revoked by tailnet network identity
Went from model routing prototype to paying customers in months
The AI Gateway itself retains no data.
They can set ZDR globally or use the per-request flag, …