Summary
On August 20, 2026, Vercel added a --bypass-all-settings flag to vercel ai-gateway api-keys create. Keys created with it are exempt from every team restriction on the AI Gateway, including the ZDR-only-models requirement, the provider/model allowlist, and the HIPAA and disallow-prompt-training filters.
What changed
Vercel's CLI gained a --bypass-all-settings flag for creating AI Gateway API keys. A key minted with the flag ignores all team-level AI Gateway policies: ZDR-only model enforcement, the provider/model allowlist, and the HIPAA and disallow-prompt-training filters.
Why it matters
AI Gateway policies are how teams centrally govern which models and data-handling terms are allowed; a blanket bypass is a powerful but risky escape hatch that can silently move workloads outside compliance guardrails. It underscores the tension between developer flexibility and centralized AI governance as gateways become policy chokepoints.
Evidence excerpt
Vercel added the --bypass-all-settings flag to vercel ai-gateway api-keys create, which "exempts API keys from all of the team's restrictions including ZDR-only models, the provider/model allowlist, and the HIPAA and disallow-prompt-training filters."