Skip to content
IOmergent
Talk to us
Home Fractional CISO Managed Cloud Security Solutions Industries Resources About Talk to a CISO

AI Security Reference ArchitecturesTrack A: Model access

A1 Direct to Provider

Developers call OpenAI and Anthropic directly with API keys. You can secure this today almost entirely with controls the vendors already ship: projects or workspaces, hard spend limits, key expiry and workload identity federation. The only custom work is a small key inventory and rotation script.

Mostly buy Owner: Individual devs Control: Low Stand up: Hours to 2 wks

Who it fits: Seed or Series A teams moving fast. The default for most engineering teams.

Frameworks: AWS GenAI scope 3AWS agentic scope No agencyOWASP LLM02 Sensitive Information Disclosure, LLM06 Unbounded Consumption

Last reviewed October 2026. Vendor tiers and features change often. Spot something out of date? Tell us.

FlowsPrompt / responseTool callIdentity / credentialTelemetryUnsafe pathBlocked
BoundariesYour boundaryThird party

How Direct to Provider works

Your environmentThird party, public internet1234ACTORDeveloperIDE, CLI, scriptsWORKLOADDev machinelaptop or VM, with EDRSECRETS.env / env varsstatic, long-lived keySIMPLIFYMODELOpenAI APIGPT modelsMODELAnthropic APIClaude modelsTELEMETRYVendor consolesusage only, per vendorKEEP

Data flow

  1. 1Developer runs code or an agent with a vendor SDK on a laptop, a local or cloud VM, or a dev container.
  2. 2A static API key is read from a .env file, a shell variable or a Codespaces secret. EDR on the machine is the main defense against infostealers that harvest these files.
  3. 3Prompts, code and context go straight to each provider over the public internet.
  4. 4Only per-vendor usage and billing is visible. There is no central prompt log, and per-user attribution needs per-user keys.

Build or buy

Mostly buy

What you can buy for each box in the diagram, the open source option, and the part you still build yourself.

ComponentBuyOpen sourceYou buildMaturity
Developer (IDE, CLI, scripts)Claude Code with a Claude Team or Enterprise seat; Codex with a ChatGPT Business or Enterprise seat, signed in through SSO··GA
Dev machineYour existing laptops, VMs or dev containers, with EDR such as CrowdStrike or SentinelOne·EDR alerts on access to .env files and credential stores, routed to your MDRGA
Secrets (.env / env vars)1Password Business (op run); cloud secrets managers; GitHub Secret Protection push protectiongitleaks, trufflehogKey inventory and expiry report built on both Admin APIsGA
OpenAI APIProjects, project keys with expiry, service accounts, workload identity federation, org and project hard spend limits·Rotation script; new keys come only from creating service accountsGA
Anthropic APIConsole workspaces with spend and rate limits, key expiry, personal and service-account keys, workload identity federation·Manual rotation runbook; the Admin API can't create keysGA
Vendor consoles (usage)OpenAI Usage and Costs API; Anthropic Usage and Cost API; Anthropic Compliance Activity Feed for admin events·Optional monthly cost-by-key export for chargebackGA

Rollout steps

#StepWhoEffort
1Inventory every existing key in both consoles and review GitHub secret scanning alertsPlatform engineer0.5 day to 2 weeks
2Create one OpenAI project or Anthropic workspace per app and environmentPlatform engineer0.5 to 5 days
3Set a hard monthly spend limit and an alert at 50 to 80 percent on each project and workspacePlatform engineer0.5 to 2 days
4Reissue keys with an expiry date: personal keys for people, service-account keys for apps, then revoke the old keysPlatform engineer1 day to 2 weeks
5Move remaining keys into a password manager or secrets manager and turn on push protectionPlatform engineer1 to 5 days
6Switch CI and cloud workloads to workload identity federation so they hold no static keyPlatform engineer3 to 10 days
7Have developers sign in to Claude Code or Codex with their SSO seat instead of a personal API keyPlatform engineer1 to 3 days

What you still build

  • A key inventory and expiry report built on the OpenAI and Anthropic Admin APIs
  • A rotation runbook: Anthropic keys are created by hand in the Console, and OpenAI keys come from service accounts
  • Optional chargeback export from the Usage and Cost APIs into a sheet or BI tool

Gotchas

  • Neither vendor lets you cap spend per key. Caps apply per OpenAI project or Anthropic workspace, plus at org level.
  • Hard limits don't apply instantly, so recorded spend can run slightly past the cap.
  • Neither vendor rotates keys for you. Set expiry dates and use federation instead.
  • Anthropic's Admin API can read, rename and disable keys but can't create them.
  • Per-user cost attribution only works with per-user keys. A shared project key hides who spent what.
  • Neither vendor keeps a central log of prompt content. The consoles show usage and cost only.
  • A password manager CLI keeps the key off disk, but the key itself stays long-lived until it expires.

Common use cases

  • Prototypes and spikes
  • Individual dev productivity
  • Hackathons and demos

Key risks

  • Keys copied across projects and laptops
  • No inspection of what data leaves
  • Shared keys hide who spent what
  • Spend caps only per project or workspace, not per key

Fast path

  • KEEPSpend cap on every project or workspace
  • SIMPLIFYKeys that expire, one project per app
  • SIMPLIFYDevelopers sign in to Claude Code or Codex with their SSO seat, no key
  • SIMPLIFYKeys in a password manager CLI such as 1Password, not .env files
  • DEFEREverything else. This is already the fast path.

Sources

Vendor documentation and announcements we checked for this page. Products are examples of a category, not endorsements.

Not sure which pieces to buy and which to build?

Bring the AI tools your teams use today and the data they touch. In a 30-minute call we map you to these models and name the controls to add first. No sales pitch.

Talk to a CISO