Lux: model access for agents

May 10, 2026

We are announcing Latere Lux. At first glance it's simple: one safe place to connect every AI model your team uses. Plug in your provider accounts, decide which models are available, and see exactly where the spending goes.

The reason we built Lux is less generic. Model access is becoming part of the runtime environment for agents. A coding agent, a research agent, or a background task does not call a model once from a tidy application server. It may run in a sandbox, invoke a CLI, write a script, spawn a helper, hand work to another agent, and keep going after the original chat window is gone.

At that point, model access should still feel like one simple front door. One place to connect. One set of providers. One usage trail. But that front door has to answer a harder question:

How do you give an agent the right model without handing every process the real provider keys?

The gateway story changed

The first generation of these tools solved a software problem. A team had several providers, several apps, and an ugly bill. A single connection point made things simpler: change one connection address, route to OpenAI, Anthropic, Gemini, OpenRouter, or Ollama, track usage, add a budget.

That is useful plumbing. Lux keeps that on-ramp.

Agents change the picture because the caller moved. The important caller may be a tool the agent picked on its own. It may be a background task it spawned five minutes into a job. It may be a long-running session that belongs to one person, runs inside one workspace, and is paid for by one team. If the only control point is a long-lived key sitting in a config file, the gateway only sees traffic after the trust decision has already been made.

Lux moves the control point back to model access itself.

What Lux gives you

Lux turns provider credentials into scoped model access.

Provider keys live in Lux. Bring an OpenAI or Anthropic account, and Lux stores the key safely and encrypted. The agent never needs the real provider key in its settings, config files, logs, command history, or anything the model can see.

Agents connect to Lux instead. The OpenAI and Anthropic tools your team already uses can talk to Lux without changes. Inside a Cella workspace, the agent can talk to a local connector; outside one, an app can call Lux directly. To the agent, it still looks like a normal model call.

Model choice becomes configuration. Allow gpt-5.2 for one session, Anthropic for another, or a model alias for a whole product. The code calling the model does not need to know which provider account is paying for it.

Usage follows the work. Every call can be tied to the organisation, person, product, session, provider, model, amount used, speed, and outcome. A team should be able to ask “what did this agent spend?” without piecing it together from three dashboards and a spreadsheet.

Budgets and approved-model lists sit at the front door. A runaway task can be stopped by revoking or narrowing its Lux access. A product can be limited to approved models. A single session can have its own spending limit. The real provider key never moves.

This is still one simple front door for AI models. The difference is that it's built for agents first, with the ready-to-use connector as the way in.

Why this belongs outside Cella and Wallfacer

Lux is a separate product because model access is not runtime lifecycle, and it is not task orchestration.

Cella owns where code runs. It should make workspaces durable, disposable, easy to watch, and isolated. It should not become the place where every model provider connection, usage record, spending rule, and approved-model list piles up.

Wallfacer owns how autonomous engineering work is broken down and reviewed. It should not hold provider keys either. A task runner may decide a model call is needed; it should not also be the keeper of the model credentials.

Lux owns the model side of the line: provider credentials, model routing, usage, spending policy, and audit records. Identity owns who is asking. Cella owns where code runs. Wallfacer owns task execution. The user should experience this as one Latere account and one bill, but the product boundaries stay clean.

The product we want

The product we want is boring at the call site and precise everywhere else.

For a developer, it should be a connection address and a key.

For an agent platform, it should be a local model connection that never leaks the real provider credentials.

For a team, it should be a dashboard that answers which model was used, by whom, for which session, under which product, at what cost.

For an operator, it should be one place to rotate provider keys, narrow model access, cap spending, and shut off a bad run.

If Lux works, most users will not think about the rules behind the scenes while a model is being called. They will notice that agents can get the models they need, that teams can see what happened, and that real provider keys do not have to travel with every process that might ask for intelligence.

Try it

Lux is live at lux.latere.ai. Sign in, connect a provider account, create a Lux key, and connect your app to the Lux address.

If your model question is no longer just “which provider should I call?” and has become “which agents, sessions, products, and people are allowed to call which models?”, reach out. We are especially interested in teams building agent platforms, running model-heavy developer tools, or trying to put shared model spend under one accountable surface.

Lux is a product of Latere. Founded by Dr. Changkun Ou.