Building an LLM gateway for a product kids use
When parents are the buyer, trust and safety isn't a layer on the product. It is the product.
IQnition started as a chat tutor called Study Sense. The chat was good. The business didn’t exist, because the user (a ten-year-old) and the buyer (their parent) wanted different things, and the thing the buyer wanted was control.
Once you accept that, the architecture changes. You are no longer building an AI that answers questions; you are building a system that makes it structurally impossible for the AI to do something a parent can’t see, limit or approve. The central component of that system is the gateway.
What the gateway does
Every model call in IQnition goes through one service. It:
- Abstracts the provider. The app doesn’t know which model it’s talking to. We have swapped providers more than once with zero app changes, which matters in a market where the best model changes quarterly.
- Applies input guardrails. What can be asked, in what context, by which account type.
- Runs eval models on the output. Generated quizzes and study plans are scored for quality and for difficulty against a curriculum knowledge graph. Below threshold, the output is regenerated. It is never surfaced.
- Records cost and latency per call. Unit economics for a consumer app are decided here, not in the pricing page.
Why evals matter more for kids
With adults, a bad quiz question is an annoyance. With a nine-year-old, a question that is too hard is a confidence problem, and a question that is wrong is a trust problem — with the parent, who will not give you a second chance.
Human tutors keep difficulty consistent by instinct. A product has to do it with evals, and it has to do it per model and per prompt version, because the thing that silently breaks difficulty is a model update you didn’t ask for.
The account model is part of the safety system
The gateway is half the story. The other half is Family Circle: a parent-rooted account graph where an under-13 profile can only exist if a parent created it and acknowledged the data terms. Plans go to the parent for approval before they are active. Visibility is a property of the graph, not a settings toggle.
This is distinct from platform family-sharing. Those handle billing. This handles consent.
The uncomfortable lesson
We added evals after we felt the pain of a quality regression, not before. If you are building anything generative for children, build the eval layer with the first prompt. It is the cheapest insurance you will ever buy.