Multi-provider AI fabric: who gets to call which model

When teachers ask which AI model writes their lessons, the honest answer is several, and the picker is not the teacher. SafeGuideEd routes work through a multi-provider fabric — Anthropic Claude for reasoning-heavy generation, OpenAI for embeddings, Google Gemini for visual analysis, Ideogram for diagram-style images, xAI Grok for an alternate image path — and a routing layer that picks the right one based on what the work needs, not which logo you trust most this quarter.

The routing layer lives behind the Portkey gateway. Every call goes through it. That single chokepoint gives us three things at once: per-call cost logging in USD, circuit breakers per provider, and a policy boundary where district administrators opt providers in or out for their tenant.

Who gets to call which model

Districts on the enterprise tier can disable any provider for their tenant. A district that has signed an Anthropic-only data agreement can flip Google off and the backend will refuse to route any call to Gemini for that district's users — even if a teacher in another tenant just hit the same endpoint successfully. The policy is evaluated at request time, not at deploy time, so the lever moves on a phone call, not on a release.

The default is permissive: all currently approved providers are active for new tenants. The exceptions tend to be districts with district-level vendor agreements that pre-date their SafeGuideEd contract. Those are surfaced in the agent-ops admin tab as a per-tenant matrix, with reasons in plain text next to each disabled provider.

How the router actually decides

The router does not balance load. It is not trying to minimize latency or save a few cents per call. It picks based on the work. A lesson generation request goes to Anthropic because Claude does the long-form reasoning we want. A text-embedding request goes to OpenAI because their embedding model is what our pgvector indexes were built against. A diagram request goes to Ideogram because Ideogram renders text in images correctly and the alternatives do not. A photo-style image request goes to Google or xAI depending on which one is healthy.

Each work type has a primary provider and a fallback. The fallback is invoked when the primary's circuit breaker is open or when the call returns a transient error. The router does not silently retry on a different family with different output characteristics — image fallback goes from one image provider to another, never from Ideogram to Claude. That keeps the output predictable for teachers.

The auditability guarantee

Every routed call writes a row to the cost ledger: tenant, user, model, token count, USD cost, latency, success or failure. Districts on the enterprise tier can pull this into their own data warehouse via signed CSV exports. Nothing leaves the gateway without being recorded, and nothing in the recording can be modified after the fact — the cost ledger is append-only at the database level for the same reason the audit logs are. We are accountable for what we charge and accountable for what we cost.

The fabric is the answer to two questions districts ask early: which AI are you using, and how do we get out if we need to. The first answer is several. The second answer is the gateway boundary — switch the provider matrix, the lessons still generate, the output still flows. No vendor lock-in pretending to be a feature.