MESH privacy classes

Every MESH request is classified into one of four privacy classes. The class controls upstream selection, logging behaviour, and the privacy block returned with the response. The router enforces the class — it cannot be silently downgraded. The class you ask for is the class served, or you get an explicit error.

Classes

Class	Label	Meaning
`standard_route`	Standard	Broad model access at the best speed and cost. MESH does not store prompts by default. Upstream privacy depends on the selected route.
`protected_provider_route`	Protected	Sensitive workloads on frontier models. MESH does not store prompts by default and routes only through providers with stronger data-protection guarantees.
`private_gateway_route`	Private Gateway	Protects requests from MESH-side logging and inspection. If a closed model is selected, that provider still processes the request through a protected route.
`confidential_runtime_route`	Confidential	Runs eligible models inside a verifiable confidential runtime. No closed external model provider receives plaintext.

How to ask for a class

Two ways. Both work on /v1/chat/completions today. Preferred — 4-class taxonomy:

{
  "model": "mesh/claude-sonnet-4.6",
  "messages": [{ "role": "user", "content": "sensitive prompt" }],
  "privacy": {
    "class": "protected_provider_route"
  }
}

Legacy — mode (still accepted):

{
  "model": "mesh/claude-sonnet-4.6",
  "messages": [{ "role": "user", "content": "..." }],
  "privacy": {
    "mode": "mesh"
  }
}

mode: "standard" maps to standard_route. mode: "mesh" maps to private_gateway_route. Both legacy aliases continue to work; new code should use class.

bestAvailable

Ask MESH to pick the strongest class the requested model actually supports:

{ "privacy": { "bestAvailable": true } }

The response tells you which class was selected. Today, a Bedrock-backed model with bestAvailable: true lands on protected_provider_route. An OpenRouter-backed model whose upstream has not been individually reviewed lands on standard_route.

allowFallbackToLowerClass

If you really need a model whose policy can’t meet your requested class, opt in to a fallback:

{
  "privacy": {
    "class": "protected_provider_route",
    "allowFallbackToLowerClass": true
  }
}

The router uses the strongest class the model CAN serve. The actual class is in the response. If you didn’t get what you asked for, you can refuse client-side. Without this flag, MESH returns HTTP 422 with privacy_class_unavailable_for_model instead of serving a weaker class.

The privacy block on responses

Every billable chat completion includes a privacy block:

{
  "model": "mesh/claude-sonnet-4.6",
  "privacy": {
    "class": "protected_provider_route",
    "label": "Protected",
    "mesh_stores_prompts": false,
    "mesh_logs_prompts": false,
    "training_on_prompts": false,
    "upstream_disclosed": false,
    "guarantee": "Uses stricter upstream data-protection requirements. MESH does not store prompts by default and training on prompts is not allowed."
  },
  "usage": { "...": "..." }
}

upstream_disclosed: false is constant. MESH never tells users which upstream provider it routed to — the same model alias may be served from different upstreams over time. The privacy class is the durable guarantee.

What each class enforces today

Property	Standard	Protected	Private Gateway	Confidential
MESH stores prompts	No	No	No	No
MESH logs prompts	No	No	No	No
Upstream training on prompts	Unknown by default	No (verified)	No	No
Model provider receives plaintext	Yes / Unknown	Yes	Yes (closed models)	No
MESH-side runtime can inspect	Yes	Yes	No	No
Runtime attestation required	No	No	Optional	Yes
Margin floor (default)	15%	20%	25%	30%

What each class is NOT

We make a point of saying what we don’t guarantee.

Standard does not guarantee anything about the upstream’s data policy. It guarantees that MESH does not store prompts. The upstream provider may log according to its own policy.
Protected does not run inference inside an enclave. It selects an upstream path with verified no-training and no-provider-sharing guarantees. The model provider still processes the request.
Private Gateway does not protect against the model provider. It protects against MESH-side operators, logs, and infrastructure. If a closed model is selected, that provider still sees the request through the protected upstream path.
Confidential is the only class where no closed external model provider receives plaintext. It requires a MESH-controlled confidential runtime + verified attestation. Today this class is only available for open-weight models on the confidential runtime.

Why upstream provider names are hidden

We choose the upstream that gives the requested class at the lowest cost and best reliability. The same model alias may be served from different upstream paths on different calls. We do not disclose the upstream because:

The privacy class is the durable guarantee. The upstream choice is an implementation detail of meeting that class.
Routing decisions change as new providers come online and as policies evolve. Pinning to an upstream would lock customers to a single implementation.
We never let a vendor name on the response imply a stronger guarantee than the class we earned.

Admin and debug surfaces can include upstream identity. Public /v1/chat/completions and /v1/models responses never do.

Margin floors

Each class has a configurable minimum margin in basis points. Routing below the floor returns HTTP 503 with margin_floor_violated.

Class	Default floor	Env var
`standard_route`	15%	`MESH_MIN_MARGIN_STANDARD_BPS=1500`
`protected_provider_route`	20%	`MESH_MIN_MARGIN_PROTECTED_BPS=2000`
`private_gateway_route`	25%	`MESH_MIN_MARGIN_PRIVATE_GATEWAY_BPS=2500`
`confidential_runtime_route`	30%	`MESH_MIN_MARGIN_CONFIDENTIAL_BPS=3000`

Class-specific markup (billing)

In addition to the floors above, PG and Confidential calls are charged at a higher MARGIN RATE than the default MESH_MARGIN_BPS=3000 (30%). This covers Nitro compute, attestation overhead, and the stricter SLOs that go with the stronger guarantee.

Class	Default margin rate	Env var
`standard_route`	30% (`MESH_MARGIN_BPS`)	`MESH_MARGIN_BPS=3000`
`protected_provider_route`	30% (`MESH_MARGIN_BPS`)	`MESH_MARGIN_BPS=3000`
`private_gateway_route`	50%	`MESH_MARGIN_PRIVATE_GATEWAY_BPS=5000`
`confidential_runtime_route`	60%	`MESH_MARGIN_CONFIDENTIAL_BPS=6000`

A PG call therefore typically costs the user ~1.5× the equivalent Protected call on the same model, before any per-call infrastructure add-ons (KMS reads, vsock round-trip). The exact user-facing total is in the usage.cost field of the response and in the signed receipt. Loss-leader behaviour is opt-in via MESH_ALLOW_LOSS_LEADER=true and intended only for limited promotional windows.

Routes that currently exist

Class	How many catalogue models qualify	How
Standard	All 88	Default for every model.
Protected	45	All Bedrock-backed routes. AWS Bedrock terms guarantee no provider data sharing and no training.
Private Gateway	0	The PG dispatch path is fully built — chat handler → Nitro parent → enclave round-trip — together with class-aware billing (50% margin by default) and a runtime gate that requires `NITRO_PARENT_URL` + `nitroParentFetch` + `defaultNitroConfig.enabled` together. The policy claim itself stays deferred until TWO additional pieces land: (a) client-side prompt encryption so the API handler never holds plaintext, and (b) a non-mock vsock transport so an operator pointing `NITRO_PARENT_URL` at a default parent boot can’t get zero-confidentiality echoes. Both are deliberate spec-level decisions: where the encryption boundary lives, and how production operators are prevented from a mock-default footgun.
Confidential	1 (Llama 3 8B on the confidential runtime)	The catalogue ships one open-weight model whose policy claims `supportsConfidentialRuntime: true` — `mesh/llama-3-8b-confidential`, served via `provider: 'confidential_enclave'`. The runtime gate additionally requires `defaultNitroConfig.enabled` AND `defaultNitroConfig.attestationEnforced` AND a non-mock parent transport. Without attestation enforcement the gate refuses with `503 privacy_class_runtime_unavailable`.

Runtime gate

For runtime-dependent classes (PG, Confidential), the router checks TWO things:

Static eligibility — the upstream policy claims it (supportsPrivateGateway: true / supportsConfidentialRuntime: true, surfaced via allowedPrivacyClasses).
Runtime availability — the deployment has the infra wired. This reads defaultNitroConfig (in @mesh/economics), the SAME constant that controls whether the actual dispatch path runs through the Nitro parent + enclave. There is one source of truth; the privacy gate and the dispatch eligibility can never disagree.

Both must hold for a per-request PG / Confidential call to succeed. If only the policy side holds, the router returns 503 privacy_class_runtime_unavailable — distinct from the 422 privacy_class_unavailable_for_model you’d get if the upstream policy itself can’t back the class.

Signed receipts

Every response carries an Ed25519 receipt covering:

Request ID
Model alias (user-visible name, never the upstream)
Privacy class served
Token counts in/out
Cost in USD
Timestamp
Public-key signer ID

The receipt does not include prompt or response content. Receipts are verifiable offline against the published signer public key — see attestation for the verification path.

Errors

Status	Code	Meaning
422	`privacy_class_unavailable_for_model`	Requested class is not earnable by the selected model. Pass `allowFallbackToLowerClass: true` to accept a downgrade, or pick a different model.
503	`privacy_class_runtime_unavailable`	Requested class is in-policy for this model but the runtime infrastructure (Nitro / attestation) is not currently wired on this deployment. Try again later, request a weaker class, or set `allowFallbackToLowerClass: true`.
503	`margin_floor_violated`	Selected route is below the configured margin floor for the served class. Set `MESH_ALLOW_LOSS_LEADER=true` to bypass.

Get started

Authentication

Core concepts

API reference

SDKs

Guides

MESH privacy classes

Classes

How to ask for a class

bestAvailable

allowFallbackToLowerClass

The privacy block on responses

What each class enforces today

What each class is NOT

Why upstream provider names are hidden

Margin floors

Class-specific markup (billing)

Routes that currently exist

Runtime gate

Signed receipts

Errors

​Classes

​How to ask for a class

​bestAvailable

​allowFallbackToLowerClass

​The privacy block on responses

​What each class enforces today

​What each class is NOT

​Why upstream provider names are hidden

​Margin floors

​Class-specific markup (billing)

​Routes that currently exist

​Runtime gate

​Signed receipts

​Errors

Classes

How to ask for a class

bestAvailable

allowFallbackToLowerClass

The privacy block on responses

What each class enforces today

What each class is NOT

Why upstream provider names are hidden

Margin floors

Class-specific markup (billing)

Routes that currently exist

Runtime gate

Signed receipts

Errors