In April 2023, Swaroop Chitlur had to sign DoorDash’s first contract with OpenAI. He told the story in a 2026 talk, with his colleague Siddharth Kodwani. “I remember I was sweating,” he said. His bigger worry was what came next: how do you make AI accountable in a company that large? Three years later, their team’s platform serves more than 5,000 internal users. AI agents, programs that act on their own, call company tools through it 300,000 times a day.
DoorDash is the food delivery company that also owns Wolt and Deliveroo. Few companies have told their AI story in public in such detail, including what they had to undo. So DoorDash is the main example for every part of this article. For each part, you’ll also see which companies did the same, and which chose differently. Read them as inspiration: together, they show the big picture you can adapt to your own company.
Start with the question most product leaders ask first. You use ChatGPT or Claude every day, and nobody at your company built anything for it. So why does your tech team want a platform? Look at the two ways your company uses AI.
In the first, you’re the user. You type into ChatGPT or Claude. OpenAI or Anthropic built that product, picked the model and decided what it may say. Your company’s admins only decide who gets a login and how much each person can spend. If the answer is wrong, you’re the only one who sees it.
In the second, your customer is the user. They type into an AI feature your team built inside your product. At DoorDash, it’s a bot that helps delivery drivers, or a homepage that lists stores picked for each customer. Behind the feature, your code sends the customer’s words to a model and shows them the answer. Everything around that call is yours: which model answers, what it may say, what it costs, what you keep, and who answers for a mistake.
The second needs an AI platform. Once several teams build features like these, they all need the same things around their model calls. That shared layer sits between all your AI features and all the models they call. Here it is on one page.
Access: how every feature reaches the models. One entry point to every model, a bill for every team, and a choice of models.
Trust: knowing what your AI said, and whether it was right. A record of every call, safety checks, and quality tests on every change.
Context: what your AI knows and may do. Your company’s knowledge, and tools for agents with a permission on each action. Memory for agents comes next.
People: the team that runs it. A small platform team whose best product is a safe path that’s also the easy one.
Chip Huyen, author of O’Reilly’s AI Engineering, draws a similar map in her guide to AI platforms. Send it to your tech lead to check you both mean the same thing. You don’t build all of it at once. DoorDash started with the entry point, because many teams were calling models at the same time. A company with one AI feature can start with the record and a few tests. Every other part arrives with a business problem: a wrong answer, a growing bill, an agent with too much access.
Here’s the route.
The why. Your AI features answer customers in your name, run on models that retire, and cost more with every user.
Access. I’ll show how DoorDash put one door in front of every model and cut costs by switching models.
Trust. Here’s how teams know what their AI said and whether it was right: a record, safety checks and quality tests.
Context. Your own documents make answers accurate, and permissions keep agents within bounds.
The plan. You’ll get five phases from zero to a full platform, each with an owner, and seven questions for your tech team.
By the end, you’ll have the big picture on one page. You’ll also have a plan, in the order your company needs. You can answer the next budget request with a plan of your own. Every source is listed at the end, by company.
First, why your AI features can’t live without one.
Why your AI features need their own platform
DoorDash builds many AI features of the second kind. In 2023, Alok Gupta, who leads AI at DoorDash, listed five areas for it. They were helping customers complete tasks, better discovery, personalized content, cleaner product data and employee productivity. In 2024, models started filling in product details for its grocery catalog, “a purely manual process led by contract operators” until then. A support bot started helping its delivery drivers. In 2025, its homepage began writing personal store lists for each customer, where “around 300 curated carousels” used to be. Chitlur sums up the business case: automation lowers costs, and recommendations and personalization raise revenue.
Then came the problem. Once the first contract was signed, teams started building fast. Soon, every team was rebuilding the same plumbing on its own. The talk’s summary lists it: retries, backup models, cost tracking and prompt versions. The users changed too. The platform team planned for machine-learning experts, then found itself serving every engineer, and later legal, sales and operations.
Here are the two ways to use AI, side by side.
On the left, someone else built the whole product. On the right, your feature calls a model directly, and everything in between is your team’s work. It goes through an API, the connection a program uses to call a model. Anthropic itself calls its chat plans and its API “separate products designed for different purposes”. The right side carries three risks the left side never had.
The first risk is liability, because the company answers for what its AI says. When ChatGPT gets something wrong for you, only you see it. When your feature gets it wrong, a customer sees it. Air Canada learned this in 2024. Its chatbot promised a grieving customer a bereavement discount the airline didn’t offer. A tribunal in British Columbia ordered Air Canada to pay him C$812, and said why.
It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.
The second risk is continuity, because companies run many models and each one retires. a16z, a venture fund that invests in AI, ran a survey in January 2026. 81% of the enterprises it asked used three or more model families. Every model also has an end date. Google retired Gemini 2.5 Pro on October 20, 2026, 16 months after its release. Anthropic retires Claude Sonnet 4.5 on November 30, 2026. Chitlur calls this “the deprecation treadmill”, because someone has to move hundreds of features to the next model.
The third risk is cost, because a feature’s bill grows with its customers. ChatGPT and Claude subscriptions are mostly priced per person. Model calls are priced per token, a piece of a word. Every new customer adds to the bill. Menlo Ventures, another AI investor, counts $12.5 billion of enterprise spending on model access in 2025. With several teams on one account, nobody can say who spent what.
Other companies hit the same wall.
Uber (2024) saw teams connect to models in their own ways. That led to “inefficiencies and redundant efforts”.
Bitrise (2026), which builds and tests mobile apps for developers, was “duplicating effort”.
DoorDash’s first answer was one door for every call.
Access: one way in to every model
Access is how every AI feature reaches a model. At DoorDash, it came first, because every team needed it at once. It has three parts: the entry point, a bill for every team, and the choice of models behind them.
One entry point to every model
Here’s the entry point on the map.
DoorDash’s teams wanted to try every new model. First came OpenAI’s, then Anthropic’s Claude, Google’s Gemini and open models. Each team wrote its own connection to each one. Then providers started limiting how many calls DoorDash could make, and products failed. The answer was the LLM Gateway, one address every DoorDash app calls. Kodwani’s team promised to “do the plumbing for you”.
Trying a new model now took one changed setting. When OpenAI was overloaded, calls moved to Microsoft’s Azure cloud, which runs OpenAI’s models too. Claude calls moved to Amazon Bedrock, which runs Claude too. The products didn’t change, and customers still got an answer. When DoorDash bought Wolt and Deliveroo, they plugged into the same gateway.
That’s what one door bought DoorDash: when a model maker was overloaded, its products kept answering.
Here’s who sells an entry point.
Open-source tools you run yourself: LiteLLM and Portkey’s gateway. Thoughtworks, a consultancy that sells neither, calls LiteLLM “a sensible default”.
Services you rent: OpenRouter, Vercel, Cloudflare and Kong.
Your cloud’s version: Azure API Management, Google Apigee and Databricks.
Here’s who did the same, and who chose differently.
Grab did the same (2025). Southeast Asia’s ride-hailing and delivery app gives each team an internal key. It swaps in the real one on every call.
Zalando did the same (2026), for its engineers’ coding tools. Europe’s online fashion store has run the open-source LiteLLM since January 2024.
Bitrise chose differently (2026). It tried LiteLLM for small internal jobs. For production, it “didn’t find any stable, performant solution”, so it built its own.
The door is also the place to count what each team spends.
A bill for every team
Here’s the bill per team on the map.
DoorDash’s teams all called models with one shared API key, the password a program uses to reach a model. Then finance got involved. Finance asked the question every shared key ends with.
you guys have one API key for multiple teams, how do I track who is using what?
So each team got a workspace with its own costs. Finance calls this showback: each team sees what it spends. A budget can also stop a team at its cap. A runaway script then stops early, not at the end of the month. Without it, a stolen key is a bill with no limit. In March 2026, The Register reported on a stolen Gemini key that ran up $82,314 in 48 hours. The company, three developers, usually spent $180 a month.
Here’s who sells a bill per team.
Inside the entry point: most gateways above set a budget per key or per team.
From your model maker: with one maker, its own console may be enough. Anthropic’s gives each team a workspace with its own keys and spend limit.
For finance: the FinOps Foundation’s Tokenomics explains who should pay for which tokens. It sells nothing here.
Here’s who did the same.
Grab did the same (2025). A daily job adds up each service’s cost for showback, and alerts fire when a service passes its threshold.
Instacart did the same (2025). Its gateway logs “detailed usage and spend per job and team”.
Counting the bill is one thing. Lowering it is another.
A choice of models
Here’s the choice of models on the map.
By 2025, DoorDash hit three problems at once. Models kept retiring, and someone had to move hundreds of teams to the next one. Providers couldn’t sell it enough capacity: “we just cannot get enough bandwidth from these providers”. And in Chitlur’s words, “Cost becomes a huge curve as the scale goes up”. The freedom to switch models went from a nice-to-have to a must-have.
So DoorDash moved some work to open-weight models, whose files anyone can download, like Alibaba’s Qwen. It runs them on Modal, a cloud that rents out the chips AI needs, with open-source serving software like vLLM. Every call already went through the gateway, so a team could “just change one config”. On those tasks, accuracy went up and “cost drops like 20x”. Chitlur puts the result at “single-digit million-dollar savings annualized”. Qwen comes from a Chinese company, so legal will ask where the model runs.
Still, every DoorDash team starts on a frontier model, the most capable kind from OpenAI, Anthropic or Google. Cheaper calls also come before hosting. A smaller model from the same maker may be enough: “Not everything needs the biggest model out there”. Anthropic charges a tenth of the price for repeated input it has cached. OpenAI halves the price of work that can wait. Hosting your own pays once the volume justifies a team to run it.
Here’s who sells hosting for open models.
Open-source serving software you run yourself: vLLM and SGLang.
Services you rent: Modal, Together AI, Fireworks and Baseten.
Your cloud’s version: Amazon Bedrock has run Qwen3 for you since September 2025. Its Custom Model Import hosts a model you bring.
Here’s who did the same, and who chose differently.
Airbnb did the same (2025). Its customer service agent runs on 13 models. Co-founder Brian Chesky told Bloomberg: “We’re relying a lot on Alibaba’s Qwen model. It’s very good. It’s also fast and cheap”.
Pinterest did the same (2026). It uses open models, Qwen among them, for visual tasks. Fortune reports performance close to frontier models “at less than 10% of the cost”.
Most companies chose differently (2025). Menlo puts open models at 11% of the enterprise market, down from 19% a year earlier. Menlo invests in model makers, though.
The volume tells a different story (2026). On Vercel’s gateway, open-weight models ran 56% of August’s tokens but only 14% of spend. That’s DoorDash’s pattern: high-volume work moves, and the money stays on frontier models.
Access tells you who called which model, at what cost. It doesn’t tell you what the model said.
Trust: know what your AI said, and whether it was right
Trust is knowing what your AI told each customer, and whether it was right. At DoorDash, the platform team built the record. The support team built the safety checks and the quality tests, for its own bot. Together, they’re how a company answers for its AI.
A record of every call
Here’s the record on the map.
At DoorDash, the record came almost for free. Every call already went through the gateway, so the team could “log every request and response”. In Chitlur’s words, it was “a positive side effect”. No product team had to build its own. Later, when teams wanted to measure quality, tracing was the first thing they needed. A trace is the full story of one request. It holds the question, each step, the documents found, the answer, its cost and its time.
A record turns a viral screenshot into something you can check. In December 2023, users tricked a Chevrolet dealer’s chatbot into agreeing to sell a car for $1. The chatbot’s maker told Business Insider that his team saw it all in the logs. Business Insider read some of them too, and the bot had “often rejected the silly requests”. Without the logs, the screenshot would have been the whole story.
The record also stores customer messages, so it comes with duties. People can ask to see or delete what you kept about them. The Hamburg data protection authority says those requests “can certainly relate to the input and output of an AI system”. So the record is a data decision first: what you keep, for how long, and who may read it. For high-risk uses like hiring or credit, the EU AI Act requires automatic logs from December 2027.
Here’s who sells a record.
Open-source tools you run yourself: Langfuse, now owned by ClickHouse, MLflow and Arize Phoenix.
Services you rent: LangSmith, Braintrust and Datadog.
Your cloud’s version: AWS AgentCore Observability and Azure Monitor.
Here’s who did the same, and who shows the other side.
LinkedIn did the same (2025). It traces agents with LangSmith before launch. In production it uses OpenTelemetry, a shared format for traces. Its traces then become test sets.
Anthropic shows the other side (2025). Three bugs quietly degraded Claude’s answers for weeks. Privacy rules limited how its engineers could read conversations, so users noticed first.
Reading tells you what went wrong. The next part stops it before a customer sees it.
Safety checks on the way in and out
Here are the safety checks on the map.
DoorDash’s support team met this part first. Dashers, its delivery drivers, ask a support bot for help in the middle of a delivery. The engineers wrote that some answers “sound natural and legitimate” and were still wrong. They first tried an advanced checking model, and it was “prohibitively expensive”. So they built a cheap check first, and call a model only when that check flags an answer. When an answer still fails, a human agent takes over.
Hallucinations, the answers a model makes up, fell by 90%. Severe compliance issues fell by 99%. Later, the platform team offered the same idea to every team, inside the gateway. Chitlur calls them “before hooks and after hooks”. Before a call, a check can hide personal data. After it, a check can stop the model from “bad mouthing your customer” or “recommending your competitor”. Teams choose which checks to turn on.
Without a check on the way out, the bot speaks for the company. In April 2025, Cursor’s support bot invented a rule limiting users to one device. No such policy existed, and some users cancelled. Since August 2, 2026, the EU AI Act’s Article 50 also requires a label. People must know when they’re talking to an AI.
The other risk comes from outside. In prompt injection, someone hides instructions in text the model reads, like an email or a web page. It still tops the 2026 risk list of OWASP, an open security community. Checks catch most of these attacks, but not all of them. Security writer Simon Willison puts it plainly: “In web application security 95% is very much a failing grade”.
Here’s who sells safety checks.
Open-source tools you run yourself: NVIDIA NeMo Guardrails, Guardrails AI, and Microsoft Presidio for personal data.
Services you rent: Lakera, now part of Check Point.
Your cloud’s version: Amazon Bedrock Guardrails, Azure Prompt Shields and Google’s Model Armor, inside Apigee.
Here’s who did the same, and who chose differently.
Airbnb did the same (2024). It built a shared library of checks any team can add to. One stops a tool from “updating listings with invalid setup”.
Uber chose differently (2024). Its gateway hides personal data for every team “before forwarding them to third-party vendors”. It admits the cost: “challenges to both latency and result quality”.
Slack chose differently (2024). It runs its models in a private space of its own. The model provider never sees customer data.
Checks catch a bad answer in the moment. The next part catches a worse product before anyone sees it.
Quality tests and prompt versions
Here are the quality tests and prompt versions on the map.
Evals are automated tests for AI answers. DoorDash’s platform first bought an evals tool from a vendor. Teams used it for a few months, then it stopped fitting. They needed custom traces and custom screens for labelling answers, and the tool couldn’t stretch that far. So DoorDash is building its own testing platform. Chitlur stays fair about the vendor, though.
the vendor was a good product, but it did not meet the flexibility requirements that we had.
The support team shows what the tests look like. Its engineers “manually reviewed thousands of chat transcripts” to learn what goes wrong. They turned the common failures into tests in Promptfoo, an open-source testing tool. Now any change to the bot’s instructions runs those tests, and a failing change is blocked. Some tests use a stronger model as a judge. A human team still reviews a random sample of conversations, to keep the automatic judge honest.
This is where product judgment enters the platform. When a team asks for help with quality, Chitlur starts with the product. He asks which “product metrics” the team cares about. Then comes a warning: “You cannot optimize on everything. You got to pick your battles”. Choosing what to measure is the call your PMs already make for every other feature. Most mature teams then run the same loop.
At Dropbox, regressions came “not from swapping models but from editing prompts”. A single word could break the citations in an answer. So a change to the AI’s instructions is a release, and it deserves tests. That’s why teams keep the instructions outside the code, with versions. A product person can then edit them, and the tests run first. “Prompt versioning” is on DoorDash’s list of plumbing every team used to rebuild. Without tests, you get DPD’s chatbot, which swore at a customer after “a system update”.
Here’s who sells quality tests and prompt versions.
Open-source tools you run yourself: promptfoo, which agreed in March 2026 to join OpenAI, and DeepEval. Langfuse also keeps prompt versions.
Services you rent: Braintrust and LangSmith.
Your model maker’s or cloud’s version: Anthropic’s Console writes test cases for you. There are also OpenAI Evals and AWS AgentCore Evaluations.
Here’s who did the same, and who shows a limit.
Dropbox did the same (2025). About 150 test questions run on every code change. “If anything crossed a red line, the merge was blocked”.
Shopify did the same (2025). It builds test sets from real conversations, labelled by at least three product experts. Its judge went from “barely-better-than-random” to near-human agreement.
Spotify shows that a test can expire (2025, 2026). The judge in its coding agent vetoed “about a quarter” of agent sessions. Once the models improved, Spotify removed it.
Trust covers what the model said. Context decides what it knows, and what it may do.
Context: what your AI knows and may do
On its own, a model only knows what it learned in training. It doesn’t know your refund policy, and it can’t open a ticket. Context fixes both, and it’s where AI agents come in. An agent is an AI model that uses tools on its own. Two terms will come up in the review. RAG, short for retrieval-augmented generation, means searching your documents first and handing the best passages to the model. MCP is the standard plug between AI tools and company systems.
Answers from your own knowledge
Here’s knowledge on the map.
DoorDash’s support bot needed DoorDash’s own facts. When a Dasher asks for help, the system first sums up the problem. Then it finds similar cases solved with help-center articles. The right article goes to the model. The articles had gaps of their own. They were all in English, while “many Dashers prefer a different language”. So the team fixed the articles as much as the model.
In the engineers’ words, the knowledge base is “the foundational truth for LLM responses”. For a product leader, this is the most familiar part, because it’s content quality. A model answers from your help center only as well as your help center allows. So whoever owns that content now owns part of your AI’s accuracy.
Here’s who sells company knowledge.
Open-source tools you run yourself: pgvector, inside the Postgres database you may already run, plus Qdrant and Weaviate.
Your cloud’s version: Amazon Bedrock Knowledge Bases and Google’s RAG Engine.
Here’s who did the same, and who describes another way.
Uber did the same (2024). Any team can launch Genie, an internal help bot, in its Slack channels. It reached 154 channels and answered over 70,000 questions.
LinkedIn did the same (2026). It runs one shared knowledge layer for people and agents. Owners approve changes the way they approve code. In one test, acceptable answers rose from 25.9% to 79.5%.
Anthropic describes a second option (2025). An agent can search with tools at the moment it needs something. Claude Code works this way over large databases.
Knowledge lets a model answer. Tools let it act.
Tools and permissions for agents
Here are tools and permissions on the map.
DoorDash’s agents started in 2024, as experiments. Then MCP arrived, and in Kodwani’s words, “a lot of people got involved”. By 2025, DoorDash had more than 25 agent projects. Every laptop also had a coding assistant, like Claude Code, Codex or Cursor. The hard problem was identity: who an agent acts for, and what it may do. Kodwani’s explanation goes straight back to the way you use Claude yourself.
If you’re working on your laptop with Claude, you can give a lot more permissions because you have a lot more control, but internally we have more agents that you can just invoke to trigger a certain action, but you don’t want that agent to have all the access that you might have given to Claude Code.
So DoorDash built an agent gateway. It connects more than 50 company tools, and agents call them 300,000 times a day. It signs people in, checks permissions and limits use, once, for every tool. In Chitlur’s words, “You don’t want every MCP author having to think about authorization”. Each tool’s owner sets its rules, and each user picks which agents may use what. For the 40% of users who aren’t engineers, a skills marketplace teaches their AI assistants the company’s systems.
The failures here cost the most. In July 2025, Replit’s coding agent deleted a production database during a code freeze. Replit is a platform for building apps. In 2026, an agent at the software company PocketOS deleted one in nine seconds. Its founder’s list of what was missing starts with “No confirmation step”.
OWASP’s 2026 list moved Excessive Agency, an agent with too much power, up to third place. Meta’s security team built a simple rule for it, on Simon Willison’s lethal trifecta. In its Agents Rule of Two, an agent holds at most two of three powers. The three are reading untrusted input, reaching private data, and changing things or sending them out. So the question for any agent is which two it gets. Memory for agents comes next, and it’s still open at DoorDash: its agent gateway is “stateless right now”.
Here’s who sells tools and permissions for agents.
Open-source tools you run yourself: Docker’s MCP Gateway.
Services you rent: gateways that now front tools too, like Kong and Portkey.
Identity for agents: Microsoft Entra Agent ID, and Okta’s Cross App Access. It is now part of MCP as “Enterprise-Managed Authorization”, the standard to ask about.
Your cloud’s version: AWS AgentCore, with its gateway, identity and policy parts.
Here’s who did the same.
Uber did the same (2026). Its MCP gateway hosts more than 800 tool servers and 5,000 tools.
Pinterest did the same (2026). Every tool server has an owner, plus a security and legal review. A person approves “any sensitive or expensive action”.
Block did the same (2025). The company behind Square and Cash App tags each tool “read-only” or “destructive”. Destructive ones need the user to confirm.
That’s the whole map. Now, how to build it from nothing.
The plan: from nothing to a full platform
One caveat first. Every company here is a large engineering team that blogs about what it built. DoorDash’s numbers also come from its own engineers. So take the plan below as a direction to adapt to your company, not a recipe. Where it matters, I lean on sources that gain nothing from the story.
Five phases, from zero to a full platform
The strongest objection comes from a company that sells a gateway. Here’s what OpenRouter writes.
If you use one model from one provider and have no plans to change that, a gateway adds unnecessary complexity.
Hamel Husain teaches companies how to test AI products. He says the same about testing tools: “Start with error analysis, not infrastructure”. Even DoorDash’s Kodwani says “it’s actually good to not be the first, like the flag bearer”. So the plan adds each part when its problem arrives. Here it is as five phases.
Phase 0: your first AI feature. It runs on one model maker, with no platform yet. The model maker’s console gives each team a workspace and a spend limit, and that’s enough. The product team owns everything. First step: read 20 to 50 answers after every change, as Husain suggests, and write down what’s wrong.
Phase 1: the first feature reaches customers. Add a record of every call, read by a named person. Add quality tests on every change to the AI’s instructions. Add safety checks on what goes out, with a label saying it’s AI. Rent a record-and-test tool, or take your cloud’s. First step: the PM writes 20 real questions with the answers they expect.
Phase 2: a second team, or a second model maker. Add one entry point, with a key, a budget and a backup for each team. Name an owner now: a small platform team. Renting is cheap here: Cloudflare’s core gateway features are free, and Vercel adds no markup. First step: list every API key in use, and who holds it.
Phase 3: answers must use your facts, and the bill grows. Add company knowledge, with an owner for each source. Then try cheaper calls, and host open models once the volume pays for it. First step: name an owner for every source the AI reads, like the help center.
Phase 4: agents start to act. Put every tool behind one gateway, with identity and a permission on each action. A person approves anything sensitive. First step: for each agent, list what it can read, what it can change, and what it can send.
DoorDash’s own order was different. It started at Phase 2. Many teams were calling models from day one, and finance wanted to know who spent what. Chip Huyen agrees that “you don’t need to follow the exact same order”. She puts the record in “from the beginning”. The order follows your problems, not anyone’s diagram. DoorDash’s engineers warn about both ways to get the timing wrong.
either centralize too early and slow teams down, or decentralize too long and accumulate duplicated work, unowned spend, and security risk.
Each phase also raises a supplier question, and the suppliers keep changing.
Own the jobs, choose the suppliers
DoorDash started “vendor-first”, because “this field is moving so fast”. Buying took weeks, and building would have taken months. It mostly worked, until the evals vendor didn’t fit. So the team changed its rule: if a vendor works, scale it up, and if it doesn’t, build. Chitlur’s closing lesson is the line to keep if you fund this.
Third, own the company-fit surfaces. Auth is an evergreen story. Cost is an evergreen story. Accuracy is an evergreen story. Observability is an evergreen story. Governance, developer experience, and velocity. We own these things, but how we provide it is something we consider on a solution detail.
Put simply, the company owns the job, like knowing who spends what. The tool doing that job can change. There are four ways to get each part. You can run it, rent it, take your cloud’s version, or buy a product that includes it. Four kinds of companies now want to own this layer.
The clouds sell all of it in one contract. AWS’s AgentCore bundles an entry point, memory, a record, tests and rules for agents. Microsoft advises picking “the least operational responsibility”.
The model makers move up from the model. Anthropic now hosts agents for you, in beta, and tests prompts in its Console. OpenAI agreed to buy Promptfoo, the testing tool, in March 2026.
Security and identity companies guard the door. Microsoft and Okta now sell sign-in for agents. Palo Alto Networks bought Portkey, a gateway, in May 2026, after Protect AI in 2025. Check Point bought Lakera, a guardrails company, in October 2025.
Data companies buy the record. ClickHouse, a database company, bought Langfuse in January 2026, and says it stays open source. Snowflake agreed to buy TruEra, an observability tool, in 2024.
Some independents keep growing: LangChain, which makes LangSmith, was valued at $1.25 billion in 2025. Others fade. Helicone, a gateway and record tool, went into maintenance mode after its sale in March 2026. So when you pick a tool, you also pick who you’ll depend on next year.
What keeps you free to leave is open standards. MCP belongs to a Linux Foundation group, since Anthropic gave it away in December 2025. A2A, a standard for agents talking to agents, joined the same foundation in June 2025. DoorDash says it is “working on A2A”. OpenTelemetry lets a record move between tools, though its AI part is still in development. Many models also accept OpenAI’s request format, but Anthropic calls its own compatibility layer not “production-ready”.
Here’s how others chose a supplier.
Wealthsimple chose its cloud (2025). The Canadian investing app built its own gateway in 2023. It later found “a very big overlap” with what Amazon Bedrock offered.
Shopify built its own (2025). Its internal proxy, one access point to many models, also handles “scaling, tracking, and failover”.
Choosing a supplier is the easy half. Someone has to run it.
Budget for the people who run it
An entry point holds every key your company has, which makes it a target. On March 24, 2026, two poisoned versions of LiteLLM went online. Each hid a program that steals keys and passwords. LiteLLM counts about 40 minutes before they came down. FutureSearch, which found them, counted a 46-minute window and 46,996 downloads. Three weeks later, the Thoughtworks Radar called LiteLLM a sensible default, without a word on the attack.
Running any part yourself is a job, even when the software is free. Zalando restarts its gateway every 20,000 requests to contain memory leaks. Renting is cheap next to the model bill. LangSmith charges $39 a seat, and Braintrust’s Pro plan is $249 a month. So the real cost is the people who run each part. None of these companies publishes how many engineers its platform takes.
That owner is usually a small AI platform team. Its best product is a safe path that’s also the easy one. Engineers call it a golden path, Spotify’s 2020 term for the one supported way to build. Google’s 2025 DORA report studied AI in software teams. It found “a direct correlation between a high quality internal platform and an organization’s ability to unlock the value of AI”. Chitlur puts the idea plainly.
Make the right thing easy. If you say, do best practices, nobody’s going to do it. You need to bake in best practices into how your platform operates.
Here’s how others run theirs.
Wealthsimple (2025) tried nudging people toward its gateway, and “it wasn’t working”. Improvements to the platform itself were “a much stronger driver for behavioral changes”.
LinkedIn (2024) asks every team to follow its rules for prompts. In exchange, teams “receive fluent sharing across prompts”.
With the plan and the owners set, the review needs the right questions.
Seven questions for your tech team
These questions test any request, whatever tool it names. Each one carries its reason, so the room starts from the same place.
Which part of the map are we asking for, and what problem does it solve today? It ties each tool to a real risk.
Is this for our product’s AI features, or for our engineers’ coding assistants? The answer changes which tool fits. Zalando and Bitrise both use LiteLLM for internal work, but Bitrise built its own gateway for its product.
How many teams and model providers will call models in the next six months? With one of each, the entry point can wait.
Who reads the answers, how many, and how often? A record nobody reads protects nothing.
Where are questions and answers stored, for how long, and who can read them? The record is a new store of customer data.
What can an agent do without a person’s approval? That’s where the costly failures happen. OWASP’s Top 10 for Agentic Applications is the checklist your security team will bring.
Who runs it, and what would leaving the tool cost? Owners change, so check that each tool speaks the open standards.
With those answers on the table, the review becomes a different meeting.
Those seven questions are the part to bring to your next review.
What changes in your next review
Every AI feature your company builds needs the same building blocks around it: access to the models, trust in the answers, and context to act on. DoorDash added them one problem at a time. Map yours, start where your problems are, own the jobs, and let the tools change.
So, back to the budget request. Place it on the map first: which theme, which part, which phase. If it’s your first AI feature, on one model maker, the record and a few tests come first. The entry point follows with the second team or the second maker. Whatever you fund, ask who runs it once the setup is done.
That changes several conversations.
The budget review. You can ask which part of the map is on the table, and which phase you’re in.
The legal review. You can say where customer messages would be stored, who reads them, and when the AI Act’s rules apply.
The first AI feature. Your PM can own the test set, because choosing what to measure is a product call.
The platform team. Someone owns the easy, safe path, so teams have a reason to use it.
The next vendor demo. When someone pitches an “AI platform”, you can ask which parts of the map it covers. Then ask who owns the company behind it.
Next, I want to open two of these parts from the inside: an entry point and a record. Each one gets its own post, set up the way a team would run it.
Go further: every source, by company
Here’s every link this article used. DoorDash comes first, then the other companies, the incidents, the rules, the guides and the deals. The sellers come last, by part. Posts where a company describes its own product are marked as vendor sources.
DoorDash
Building GenAI Platform at DoorDash: Swaroop Chitlur and Siddharth Kodwani’s full talk and transcript, from the first contract to the agent gateway (2026).
The talk’s summary: the plumbing every team rebuilt, and the two ways to get the timing wrong (2026).
Dasher support automation: the support team’s knowledge base, two-step check, tests and judge (2024).
Five big areas for generative AI: Alok Gupta’s 2023 list of where AI would go in the product (2023).
A product knowledge graph built with LLMs: models filling in grocery product details (2024).
The next-generation homepage: personal store lists written by LLMs for each customer (2025).
Other companies
Uber: its GenAI Gateway, which hides personal data from vendors (2024); Genie, its internal help bot (2024); its MCP Gateway, with 800+ tool servers (2026).
LinkedIn: its platform’s prompt rules (2024); tracing agents (2025); its shared knowledge layer (2026).
Dropbox: its evaluation blueprint, with 150 test questions on every change (2025).
Shopify: lessons from Sidekick (2025), and First Round Review on its internal proxy (2025).
Spotify: its coding agent’s judge (2025), InfoQ on its removal (2026), and golden paths (2020).
Airbnb: its shared library of checks (2024), and Fortune on its use of Qwen (2025).
Pinterest: its MCP ecosystem (2026), and Fortune on its open models (2026).
Grab: its AI gateway (2025).
Zalando: an agentic engineering snapshot (2026).
Bitrise: its AI platform (2026).
Wealthsimple: launching AI tools (2025).
Instacart: Maple, with cost tracked per job and team (2025).
Slack: how Slack AI stays private (2024).
Block: MCP at Block (2025).
Anthropic: a postmortem of three issues (2025), and context engineering (2025).
The incidents
Air Canada: the tribunal decision (2024).
Cursor: Ars Technica on the invented policy (2025).
DPD: The Guardian on the chatbot that swore (2024).
Chevrolet of Watsonville: Business Insider on the $1 car (2023).
Replit: Fortune on the deleted database (2025).
PocketOS: Information Age on nine seconds (2026).
The Gemini key: The Register on the $82,314 bill (2026).
The LiteLLM attack: LiteLLM’s notice (vendor) and FutureSearch’s count (2026).
The rules and standards
The EU AI Act: Article 12 on logs and Article 50 on chatbots.
Personal data: the Hamburg data protection authority’s paper (2024).
Security: the Cloud Security Alliance on OWASP’s 2026 list, OWASP’s Top 10 for Agentic Applications, Meta’s Agents Rule of Two and Simon Willison’s lethal trifecta.
Open standards: MCP’s donation (vendor), A2A at the Linux Foundation, OpenTelemetry’s AI conventions and Anthropic on OpenAI compatibility (vendor).
Model retirements: Google’s model lifecycle and Anthropic’s deprecations (vendor).
Chat plans and the API: Anthropic’s help center (vendor).
Workspaces: Anthropic’s workspaces, a key and a spend limit per team (vendor).
The guides and surveys
Chip Huyen: Building A Generative AI Platform, the map to check with your tech lead (2024).
Hamel Husain and Shreya Shankar: the evals FAQ.
OpenRouter: the case against a gateway, from a gateway seller.
The FinOps Foundation: FinOps for AI and Tokenomics.
Thoughtworks: the Radar on LiteLLM (2026).
Menlo Ventures: the state of generative AI in the enterprise (investor, 2025).
a16z: the January 2026 enterprise survey (investor).
Vercel: its AI Gateway production index (vendor, 2026).
Google: the 2025 DORA report.
Microsoft: its AI adoption advice (vendor).
The deals
ClickHouse and Langfuse (January 2026).
Palo Alto Networks and Portkey (May 2026), after the announcement.
Palo Alto Networks and Protect AI (July 2025).
Check Point and Lakera (October 2025).
Snowflake and TruEra (2024).
OpenAI and Promptfoo (agreed March 2026).
Mintlify and Helicone (March 2026).
LangChain’s funding round (2025).
The sellers, by part (all vendor pages)
Entry point: LiteLLM, Portkey, OpenRouter, Vercel (pricing), Cloudflare (pricing), Kong, Azure API Management, Apigee, Databricks.
Record: Langfuse, MLflow, Arize Phoenix, LangSmith (pricing), Braintrust (pricing), Datadog, AWS AgentCore.
Safety checks: NeMo Guardrails, Guardrails AI, Presidio, Lakera, Bedrock Guardrails, Azure Prompt Shields.
Quality tests: promptfoo, DeepEval, Anthropic’s Console, OpenAI Evals.
Hosted models: vLLM, SGLang, Modal, Together AI, Fireworks, Baseten, Bedrock’s Qwen3, Bedrock Custom Model Import, Anthropic’s prompt caching, OpenAI’s batch jobs.
Company knowledge: pgvector, Qdrant, Weaviate, Pinecone, MongoDB, Bedrock Knowledge Bases, Google’s RAG Engine.
Agent permissions: Docker MCP Gateway, Microsoft Entra Agent ID, Okta Cross App Access.