Tailscale routes AI model access through network identity

Tailscale built its customer-facing model router, Aperture, on top of Vercel's AI Gateway and Sandbox. The access model works like joining a VPC. Add someone to the tailnet and they can use approved models right away; remove them and access disappears.

No agent gets an API key. Sandboxes connect through Aperture, which checks tailnet identity before letting anything execute. Most teams solve that problem with vaults and rotation schedules: issue a credential, track where it lives, rotate it, hope nothing leaked in between.

Tailscale describes the cutover, in Vercel's writeup, as moving its entire org onto AI Gateway "in seconds, and nobody noticed." A full-company migration with no reported disruption says the identity layer sat underneath existing workflows rather than replacing them.

Vercel's writeup doesn't say what building an equivalent identity layer costs a team that doesn't already run a tailnet. Tailscale had the network before it had the router.