Tetrate Agent Router vs. Portkey: Which AI Gateway for Enterprise?

TL;DR

Portkey was acquired by Palo Alto Networks (closed May 29, 2026) and is now part of the Prisma AIRS security platform. If you are evaluating Portkey today, you are evaluating a product whose roadmap, pricing, and independence are now determined by a large enterprise security vendor. Tetrate Agent Router is an independent, purpose-built AI gateway on the Envoy AI Gateway data plane — by the team that created it.

What each product is for

Portkey was designed around the application: routing, retries, prompt versioning, caching, and observability for LLM apps. It is now part of Palo Alto Networks’ Prisma AIRS platform, where it serves as the foundational AI gateway for monitoring, orchestrating, and governing AI interactions across enterprise environments.

Tetrate Agent Router is designed around the organization: a governed control point with authenticated identity, per-team token attribution, runtime guardrails, and compliance-grade audit — built on the Envoy AI Gateway data plane by the team that created the project, with Bloomberg.

Both expose an OpenAI-compatible API across multiple LLM providers. The divergence is scope and ownership: Portkey is now a component inside a security platform; Tetrate Agent Router is an independent, purpose-built product.

What the Palo Alto Networks acquisition means for Portkey customers

Palo Alto Networks announced its intent to acquire Portkey on April 30, 2026, and closed the deal on May 29, 2026. Portkey is now integrated into Prisma AIRS — Palo Alto Networks’ AI security platform — alongside Chronosphere (observability) and Idira (agent identity security).

For enterprise buyers evaluating Portkey, three questions are now relevant:

Roadmap independence: Portkey’s product direction is now determined by Palo Alto Networks’ Prisma AIRS roadmap, not the original Portkey team’s priorities. Features that served developer-focused use cases may be deprioritized in favor of security-platform integration.

Platform lock-in: Portkey’s value proposition is increasingly tied to the broader Palo Alto Networks ecosystem. Organizations not already running Prisma products may find the integration points less useful, and the exit path harder over time.

Pricing trajectory: Acquisitions into enterprise security platforms historically move pricing upmarket. Portkey’s current pricing may not reflect where it lands post-integration.

Tetrate is an independent company with a single focus: AI gateway and application networking infrastructure. There is no acquisition uncertainty, no security-platform dependencies, and the product is built by the team that co-created and maintains the underlying Envoy AI Gateway open-source project.

One management plane, distributed data planes

Portkey offers a managed SaaS, a fully self-hosted option, and a hybrid option. In the hybrid option, Portkey runs the control plane and the gateway runs in your cloud, so AI traffic stays in your network. Tetrate Agent Router Enterprise runs a different architectural model: one Tetrate-run management plane, with data planes deployed wherever your agents run. Data planes can run Tetrate-hosted, inside your own cloud VPC (AWS, Azure, GCP), on-premises, at the edge, or per-region with localized model catalogs and data controls. You can run different guardrails, different model catalogs, and different compliance policies per data plane, all governed from a single control point.

This matters when agents span multiple teams, geographies, or regulatory jurisdictions. A financial services firm running agents in the EU and US can enforce GDPR-grade controls on the EU data plane and different policies on the US plane — from the same Tetrate-run management plane, without duplicating logic in each application.

The management plane is not in the data path. Each data plane keeps a local copy of the rules. If the management plane is unreachable, AI traffic and speed do not change. Only rule changes wait. Tetrate runs the management plane with at least 99.9% uptime and SOC 2 Type II audits. Each data plane connects out to Tetrate, and nothing connects in. The customer chooses what reaches the management plane, so prompts can stay in the customer’s network.

How the two gateways are built

Sources: Portkey hybrid architecture.

Portkey’s hybrid option and Tetrate use a similar design. The differences are ownership, the data plane, and focus. Palo Alto Networks now owns Portkey, and Portkey serves as the AI gateway for Prisma AIRS. Tetrate is independent and provider-neutral. Tetrate’s data plane is Agent Router, the open source gateway that Tetrate co-created and that now belongs to the Agentic AI Foundation. Broadcom measured about 2 ms of overhead for that data plane.

Head-to-head comparison

Choose Portkey / Prisma AIRS when

• Your organization is already standardized on Palo Alto Networks and you want Portkey’s capabilities integrated into your existing Prisma security stack.
• Your primary concern is AI security within a broader SASE/Zero Trust architecture.
• You are comfortable with roadmap and pricing decisions made by a large enterprise security vendor.

Choose Tetrate Agent Router when

• You need an independent AI gateway not tied to a security-platform vendor’s roadmap.
• You are running agents across multiple teams, regions, or providers and need a single governed control point.
• Compliance, audit, or data-residency requirements drive your architecture.
• You want to build on the Envoy AI Gateway data plane — maintained by the team that created it.

Frequently asked questions

Is Tetrate Agent Router a Portkey alternative? Yes — both expose an OpenAI-compatible endpoint. The difference is now also about vendor independence: Portkey is part of Palo Alto Networks’ Prisma AIRS platform; Tetrate Agent Router is an independent product built on Envoy AI Gateway by its creators.

Does Portkey still support self-hosted deployment post-acquisition? Portkey offers a managed SaaS, a fully self-hosted option, and a hybrid option. In the hybrid option, Portkey runs the control plane and the gateway runs in your cloud, so AI traffic stays in your network. Verify current packaging with Palo Alto Networks post-acquisition.

Which has better observability? Portkey was purpose-built for app-layer observability and strong there — now extended with Palo Alto Networks’ Chronosphere integration for infrastructure-level telemetry. Tetrate adds attribution, identity binding, and immutable audit across teams. These address different layers and are not directly comparable.

What does the Palo Alto Networks acquisition mean long-term? Portkey is now the foundational AI gateway inside Prisma AIRS. Palo Alto Networks’ stated goal is a unified AI security platform. For buyers evaluating Portkey as a standalone AI gateway, the product they are buying today is on a path toward deeper platform integration — with the pricing, roadmap, and exit dynamics that typically follow enterprise security acquisitions.

Compare other gateways: vs. OpenRouter · vs. Kong AI Gateway · vs. Bifrost · vs. Cloudflare AI Gateway · vs. Envoy AI Gateway (OSS) · vs. LiteLLM

See the full 2026 enterprise AI gateway comparison.