AI behavior and limits
An AI resource lets your code call the customer's models with no key to leak, and Alien adds no limits of its own. Below are its guarantees, its limits, how it translates between protocols, and what it does on each cloud.
Guarantees
No keys in your application. On AWS, GCP, and Azure, the workload's own identity (IAM role, service account, or managed identity) authorizes every call. Nothing in the binding is a credential, so there is no key to leak, rotate, or scope. Inference bills to the customer's cloud account.
A private endpoint. The gateway listens only on the loopback interface inside the workload it's linked to. It's never exposed on the network.
Native requests pass through unchanged. When you call a model on its native protocol, the request body reaches the provider as you wrote it, including fields Alien doesn't know about, and the reply streams back unchanged. The one exception is Claude on AWS, described under Protocols.
Translation fails loudly. When you call a model on another protocol, Alien translates only fields that mean the same thing on both sides. A field that can't be represented returns a 400 before any request reaches the provider, so nothing is billed.
Limits
| Limit | Value | Notes |
|---|---|---|
| Request body | 32 MiB | Returns 413. Providers cap requests below this (Bedrock InvokeModel at 25 MB), so their limit is usually the one you hit. |
| Model id | Must be in Alien's list for that cloud | Any other id returns 404 without reaching the provider. |
| Default output tokens | 4,096 | Applied only when a request translated to Anthropic Messages has no output limit, since Messages requires one. |
| Azure throughput per model | 1 GlobalStandard unit | A conservative default. Raise it per model in the Azure portal. A re-provision resets it. |
| Resource id | [A-Za-z0-9-_], up to 64 characters | Immutable after create. |
Beyond the body cap, Alien adds no limits to inference. There is no rate limit, request timeout, concurrency cap, or token ceiling.
The provider's quotas apply directly, and a provider 429 reaches you as a 429 with its Retry-After header. If your workload is public, put your own limits in front of it.
Changing a live resource. The id is immutable and there is nothing else to configure, so there is no resize, version pin, or update that can disrupt a running workload.
Protocols
Each model has one native protocol:
| Models | Native protocol | Endpoint |
|---|---|---|
| Claude, on every cloud | Anthropic Messages | /v1/messages |
| GPT-5 family (AWS) | OpenAI Responses | /v1/responses |
gpt-oss-20b, gpt-oss-120b (AWS) | Chat Completions and Responses | either |
| Everything else | OpenAI Chat Completions | /v1/chat/completions |
The gateway picks the model from the model field in the body, not from the path. When the path isn't the model's native protocol, the gateway translates the request and the response.
Translation keeps only portable fields. These fail with a 400 when translated:
- Streaming with tools. Use a non-streaming request, or call the model on its native protocol.
- Built-in Responses tools, such as web search. Function tools translate.
- Anthropic-only fields:
cache_control,thinking,container,mcp_servers,context_management,inference_geo. Messagemetadataother thanuser_id. - OpenAI-only fields such as
audio,logprobs,logit_bias,frequency_penalty, and the legacyfunctionsandfunction_call. - Responses state:
store,background,truncationother thandisabled,include,metadata,prompt_cache_key,max_tool_calls, reasoning summaries, andtext.verbosity. - Images sent to Claude as URLs. Only base64
data:URLs translate.
The error names the field. Remove it, or call the model on its native endpoint.
Claude on AWS
Bedrock serves Claude through an older Anthropic schema, so Alien adapts the request on AWS:
- Anthropic's server-executed tools, such as web search and code execution, are dropped. Client-executed tools that Bedrock hosts (
bash_,text_editor_,computer_,memory_,tool_search_) are kept. output_configandcontext_managementare dropped. Athinkingmode other thanenabledordisabledis dropped.- Mid-conversation system messages are folded into the turn before them.
Those edits apply only on AWS. On every cloud, Alien forwards only a known set of anthropic-beta families: claude-code-, computer-use-, context-1m-, context-management-, fine-grained-tool-streaming-, interleaved-thinking-, output-128k-, token-efficient-tools-, and tool-examples-. Other betas are dropped.
Model id spellings
The gateway accepts the spellings that Claude clients send. claude-haiku-4-5, claude-sonnet-4-5-20250929, claude-sonnet-4-5@20250929, and us.anthropic.claude-haiku-4-5-20251001-v1:0 all resolve to Alien's ids (claude-haiku-4.5, claude-sonnet-4.5). A byo/ prefix is accepted on any id.
Model availability
Inside the workload, getAvailableModels() returns Alien's model list for the cloud. It doesn't call the provider, so it's instant and never fails because of the cloud.
A model the customer hasn't enabled is still listed. Calling it returns the provider's error, which the gateway reports as provider_access_unavailable. Handle that error for a model you haven't called before.
Separately, Alien checks real availability every 15 minutes, outside the workload, and reports it in the resource's status:
| Cloud | How it checks | What it reports |
|---|---|---|
| AWS | GetFoundationModelAvailability per model, 8 at a time | Agreement, entitlement, authorization, and region status. The GPT-5 family has no foundation-model record, so it's reported as unknown. |
| GCP | The Model Garden catalogs for the google and anthropic publishers | Whether each model is listed, and for Claude, whether Anthropic's terms are accepted. |
| Azure | The account's deployments | Available when a deployment with the model's name reached Succeeded. |
The check only reads the provider's management APIs. It never calls a model or uses quota.
When any model's status is unknown, the resource reports degraded health with "Some model availability could not be observed". A missing model never fails a deploy on AWS or GCP.
Claude is the one family behind a one-time customer step on every cloud. See Models.
Platforms
AWS: Amazon Bedrock
Nothing is provisioned. Deploying the resource grants the workload ai/invoke on foundation-model/*, and deleting it removes nothing.
- AWS has the widest model list, including the GPT-5 family and every Claude model.
- Claude calls go through Bedrock
InvokeModelusing cross-region inference profiles. - The GPT-5 family and Responses calls go to the
bedrock-mantleendpoint.
GCP: Vertex AI
Alien enables aiplatform.googleapis.com and grants a custom role limited to prediction, instead of the broad roles/aiplatform.user. Deleting the resource leaves the API enabled, since other stacks may use it. Gemini and Claude are available.
Azure: Azure AI Foundry
Azure is the only cloud where Alien creates something lasting: an AIServices account (S0) and deployments of gpt-4.1 and model-router, each at 1 GlobalStandard unit. The workload gets the Cognitive Services User role on the account.
The account appears in the customer's portal and on their bill. Deleting the resource deletes the account and its deployments.
Alien creates the deployments together. If any deployment ends in Failed or Canceled, the resource fails, for example when the region doesn't offer the model at GlobalStandard or quota is zero.
Nothing checks this before the account is created. See Models for how to check a region first.
Claude needs Marketplace terms accepted in the portal, which no API can do, so the customer deploys it there once.
Kubernetes and Machines
Alien doesn't provision AI. Supply an external AI binding with your provider key at deploy time, and the SDK calls that provider directly.
Add the binding together with the resource. Without one, the deployment fails at deploy time, not at validation.
Local
An external binding using OpenAI, with the key from OPENAI_API_KEY. alien dev fails with an actionable error if it's unset.
getAvailableModels() returns a short built-in list. Set ALIEN_AI_LOCAL_BASE_URL to point at any OpenAI-compatible server, including one on your machine.
Design decisions
No configuration on the resource. Model, temperature, and every other setting belong to the request, so changing models doesn't need a release, and one stack works across three clouds whose model menus differ.
Native first, translation second. Calling a model on its native protocol gives you its full API, including fields Alien hasn't seen. Translation lets one client reach every model, but only for fields that mean the same thing on both sides; anything else fails before it's sent.
The in-workload list isn't probed. Probing models from inside the workload would add latency and spend quota on startup. Alien checks availability in the background instead, outside the workload, and the workload lists the catalog.
No Alien rate limit. Any limit Alien imposed would be a second ceiling below the provider's real quota, and a number you couldn't plan against.
Delete removes the Azure account. On Azure, deleting the resource deletes the AI Foundry account and its deployments, like every other Alien resource. AWS and GCP have nothing to delete.