Ever seen an LLM gateway spit out “Something went wrong, please try again”? That cryptic error hides a battlefield of tradeoffs.
The Simple Version
Think of an LLM gateway like a traffic light that can’t change its mind once green.
How It Actually Works
Streaming Commitment
When a response starts streaming you have already committed to that provider.
Why Retries Mislead
Retrying a slow call eats latency budget and multiplies cost.
Per‑Request Fallback
Use per request fallback instead of circuit breakers when a healthy second provider exists.
Guardrails as Services
Guardrails can fail too; decide in advance whether you fail open or closed.
Technical Deep Dive
Track P99 per model per route and set timeouts consistently; missing timeouts cause silent outages.
Measure latency per route, not gateway‑wide, because a reasoning model’s normal load differs from a chat model’s outage.
Design fallback logic that gives backup providers headroom, not less, to absorb spikes.
Implement hedging on the tail: send a request to a second provider when latency crosses a threshold.
Centralized governance can be achieved without a single traffic hub by using shared config and policies.
Why This Matters
Real‑world apps lose revenue when a gateway silently drops requests during peak traffic.
Customers notice slower responses the moment fallback logic fails, eroding trust.
Proper architecture prevents cost explosions from repeated retries on expensive models.
Key Takeaways
- Streaming locks you into a provider once the first token flows.
- Per‑request fallback beats circuit breakers when a backup is healthy.
- Track P99 per model to catch hidden latency spikes.
- Set explicit timeouts to avoid silent outages.
- Treat guardrails as services that can fail open or closed.
- Governance ≠ central gateway; share policies instead of traffic.
- Cost rises fast if retries multiply expensive token usage.