Skip to main content

DeepSeek Integration

Add governance to DeepSeek API calls. Control Zero intercepts requests through the Governance Gateway and enforces your dashboard policies on every interaction.

Overview​

DeepSeek provides reasoning and coding models via an OpenAI-compatible API. When routed through the Control Zero Governance Gateway, every request is governed by your policies and logged for audit.

DeepSeek uses the OpenAI-compatible wire format, so the integration reuses the same interceptors and policy enforcement as the OpenAI integration.

Setup​

1. Configure the Gateway​

Enable the DeepSeek provider in your Governance Gateway configuration:

# Environment variables for the gateway
CZ_GATEWAY_DEEPSEEK_ENABLED=true
CZ_GATEWAY_DEEPSEEK_API_KEY=your_deepseek_api_key

2. Route Requests Through the Gateway​

Point your client at the gateway's DeepSeek endpoint:

import openai

# Route through Control Zero gateway instead of direct DeepSeek
client = openai.OpenAI(
    base_url="http://localhost:8000/deepseek",
    api_key="cz_live_your_key_here",
)

response = client.chat.completions.create(
    model="deepseek-chat",
    messages=[{"role": "user", "content": "Explain the CAP theorem in distributed systems."}],
)
print(response.choices[0].message.content)

3. Define Policies​

Create policies in the dashboard to govern DeepSeek usage:

{
  "name": "deepseek-usage-policy",
  "rules": [
    {
      "effect": "allow",
      "action": "llm:chat.completions",
      "resource": "deepseek/*",
      "conditions": { "model": ["deepseek-chat", "deepseek-coder"] }
    },
    {
      "effect": "deny",
      "action": "llm:chat.completions",
      "resource": "deepseek/*",
      "conditions": { "max_tokens_gt": 8192 }
    }
  ]
}

What Gets Governed​

API EndpointPolicy ActionDescription
POST /deepseek/chat/completionsllm:chat.completionsChat completions (streaming and non-streaming)
POST /deepseek/completionsllm:completionsText completions
GET /deepseek/modelsllm:models.listModel listing

Streaming Support​

The gateway fully supports streaming responses from DeepSeek. Server-sent events are forwarded transparently while policy enforcement and audit logging occur on the initial request.

Tool Call Governance​

DeepSeek models that support tool use (function calling) are fully governed. The gateway intercepts tool call responses and evaluates each tool invocation against your policies before forwarding to the client.

{
  "name": "deepseek-tool-restrictions",
  "rules": [
    {
      "effect": "allow",
      "action": "mcp.tool.call",
      "resource": "mcp://filesystem/read_file"
    },
    {
      "effect": "deny",
      "action": "mcp.tool.call",
      "resource": "mcp://filesystem/write_file"
    }
  ]
}

Audit Logging​

All DeepSeek requests routed through the gateway are logged in the audit trail with the provider identified as deepseek. View them in the dashboard under Audit Log with the provider filter.