Use someone else's router

Your agent can use a router that someone else runs: a model provider serving its own models, or a central router at your company.

What you need from them

its name	the router’s identity, such as large.example.com
its address	where it listens, such as https://large.example.com
a route name	the name of the model to use, such as large
admission	they add you to their rules: your agent’s name, or you as a person

They need no key from you, and you need none from them.

Point an engine at it

hexaeight-activate engine --add chat \
    --name   chat \
    --model  "large|<model id>" \
    --router "large.example.com|https://large.example.com"
heia restart agent

When the agent starts, it checks that the address answers as that name. If it does not, the agent turns that engine off and says why in its log.

Each engine names its own router, so some engines can use your own router and others someone else’s.

Who they see

your agent is working for	their router sees
a person signed in to your agent	that person, proven with their own key
a caller from outside, with outside callers kept private	only your agent

Keep outside callers private

For people and agents that reach your agent from outside, your agent can keep every caller private. It sends :opaque: instead of who the caller is, and the router records the call against your agent. In hexaeight-agent.json, add this to the external section:

"opaqueCallers": true

Then restart the agent with heia restart agent. Your agent still records each caller in its own audit trail.

A router can refuse private callers (requireIdentifiedCaller). A provider’s router usually accepts them; a company’s router for its own people usually refuses them.

Next

• Serve models to agents: the provider’s side
• Run your own router