# Omnia vs Portkey

> Omnia checks each tool call’s arguments and caller, refuses what it can’t approve, and runs the agent in your cluster. Portkey’s guardrails govern the model call.

Category: Gateways and guardrails. Checked against Portkey, now part of Palo Alto Networks’s published material on 2026-10-22. Canonical page: https://www.altairalabs.ai/vs/portkey/

## Portkey governs the model call. Omnia governs the tool call.

An injected instruction does harm when the agent acts on it, so Omnia’s checks sit on the tool call: its arguments and the person behind it. Portkey, now part of Palo Alto Networks, is a model gateway, and its guardrails see the model call.

## When it matters: A retrieved document carries an instruction to pay a supplier’s new bank account.

**On Omnia:** The model is convinced, and the agent calls the payment tool. The account isn’t on the approved list and the caller isn’t authorised for payments, so policy refuses the call. The audit records both reasons. (Omnia docs: https://omnia.altairalabs.ai/how-to/security/configure-tool-policies/)

**On Portkey:** Portkey only evaluates the last message in the request body when running guardrail checks. Policy on tool-call arguments isn’t documented. (source: https://portkey.ai/docs/product/guardrails)

## Policy on what the agent does

A rule can say who may call the payment tool and which accounts it may pay. A broker checks both on every call. *(enterprise)* (Omnia docs: https://omnia.altairalabs.ai/how-to/security/configure-tool-policies/)

Portkey: Guardrails check the last message; the MCP gateway controls which tools each user can call. (source: https://portkey.ai/docs/product/mcp-gateway)

## Fails closed by default

A call policy can’t approve doesn’t run, including when the broker can’t answer. The decision goes into the transcript and into a compliance record. *(enterprise)* (Omnia docs: https://omnia.altairalabs.ai/how-to/security/configure-tool-policies/)

Portkey: With Deny off, a request that fails a check is still sent, with a different status code. (source: https://portkey.ai/docs/product/guardrails)

## Budgets for everyone

Budgets per agent, provider or workspace are in the free core, daily or monthly, with an action on breach. (Omnia docs: https://www.altairalabs.ai/scale)

Portkey: Budget limits that expire a key are on Enterprise and select Pro plans. (source: https://portkey.ai/docs/product/ai-gateway/virtual-keys/budget-limits)

## At a glance

| Topic | Omnia | Omnia docs | Portkey | Portkey docs | Source |
|---|---|---|---|---|---|
| Model providers | Seven native protocols and any OpenAI-compatible URL. | https://omnia.altairalabs.ai/reference/core/provider/ | A very large catalogue, with fallbacks. | documented | https://github.com/Portkey-AI/gateway |
| Argument-level tool policy | A CEL rule on every call. *(enterprise)* | https://omnia.altairalabs.ai/how-to/security/configure-tool-policies/ | Not documented. | not documented | https://portkey.ai/docs/product/guardrails |
| End-user identity in policy | Yes. *(enterprise)* | https://omnia.altairalabs.ai/reference/policies/toolpolicy/ | Identity headers to MCP servers. | partly documented | https://portkey.ai/docs/product/mcp-gateway |
| Blocking budgets | Free core. | https://www.altairalabs.ai/scale | Enterprise and select Pro. | partly documented | https://portkey.ai/docs/product/ai-gateway/virtual-keys/budget-limits |
| Red teaming before release | Adversarial callers gate the release. | https://promptarena.altairalabs.ai/arena/how-to/voice/voice-red-team/ | Not documented. | not documented | https://portkey.ai/docs/product/guardrails |
| Runs the agent | Yes. | https://omnia.altairalabs.ai/tutorials/progressive-rollouts/ | Gateway only. | not documented | https://github.com/Portkey-AI/gateway |

## Questions

**Can I use Portkey with Omnia?**

Yes. Point an Omnia provider at Portkey’s OpenAI-compatible endpoint and Omnia’s tool policy, testing and rollout sit on top.

**Who owns Portkey?**

Palo Alto Networks completed its acquisition of Portkey in May 2026; the gateway is now the Prisma AIRS AI Gateway.