← All posts

Platform & Architecture

227 posts on platform & architecture.

Anthropic MCP Server Security: The Enterprise Controls That Sit Around Claude's Tool Layer

Anthropic's Model Context Protocol implementation lets Claude call tool servers with a standard schema. The enterprise question is what security controls have to sit around the MCP server when the LLM behind the protocol is Claude. This piece walks through the controls: transport authentication to the MCP server, token exchange between Claude's session and the tool call, response inspection before the tool result reaches the model, and audit records tied to the human user who authorized the session.

anthropicmcpclaudeai-securityai-agentai-gateway
Read post →

LLM Vector Store Access Control: The Filters That Have to Run on Every RAG Query

The vector store holds embeddings the enterprise's users, tenants, and documents contributed. Every retrieval-augmented generation query has to run access-control filters against the store before the retrieval reaches the LLM context. This piece walks through the filter design that survives multi-tenant SaaS, cross-department access, and time-bounded document lifecycle: per-vector metadata, query-time filter injection, retrieval-response inspection, and the audit records that prove the filter held on every query.

ragvector-storeaccess-controlai-securityai-gatewayllm-dlp
Read post →

AI Cost Attribution Per Team: The Record Design That Turns AI Spend Into a Chargeback Line Item

Finance teams asking for AI cost attribution per team run into the same problem every time: the model provider's invoice shows the aggregate account spend, not the per-team consumption. Attribution has to happen at the gateway, where the enterprise can tag each request with the team, application, and user identity. This piece walks through the record design that produces attributable AI spend, the tagging pattern that survives multi-model deployments, and the reports the finance team accepts as chargeback evidence.

ai-costchargebackai-gatewayfinanceattributionai-governance
Read post →

A JSON Schema for AI Audit Logs: The Fields a Regulator, an Auditor, and a SIEM All Need in the Same Record

AI audit logs need one schema that satisfies a regulator during an Article 12 audit, an internal auditor during an ISO 42001 certification, and a SIEM during an active incident. Most deployments produce three log formats and reconcile them after the fact. This piece walks through a single JSON schema with the required and optional fields, the identity representation, the policy-state representation, and the storage-layer contract that makes the schema durable.

ai-audit-logsjson-schemasiemeu-ai-actiso-42001ai-engineering
Read post →

MCP Server Authentication: Identity Binding at the Model Context Protocol Boundary

The Model Context Protocol lets an LLM client discover and call tools exposed by an MCP server. Authentication at the MCP boundary determines which identity issues the tool calls, which policy applies, and which record ends up in the audit log. This piece walks through the OAuth 2.1 authorization flow the MCP spec adopted, the pitfalls in shared-secret patterns, and the inspection-layer architecture that binds every MCP tool call to a verified identity.

mcpauthenticationoauthai-agent-securityai-engineering
Read post →

AI Gateway Cache Invalidation: When a Cached Prompt Response Becomes a Data Leak

AI gateways cache prompt responses to cut cost and latency. The cache lookup uses a hash of the prompt as the key, which means two callers with different authorization scopes can hit the same cache entry. This piece walks through the failure mode, the identity-scoped cache-key patterns that avoid it, and the inspection-layer architecture that makes cache lookup safe.

ai-gatewaycachingai-engineeringdata-leakai-security
Read post →

AI Agent OAuth Consent: The Permission Screen Users Never Read and the Blast Radius It Grants

An AI agent that authenticates to a SaaS application via OAuth requests a consent scope from the user. The scope grants the agent standing authorization to call APIs on the user behalf. Users grant scopes they do not read, and the standing authorization outlasts the interaction that produced it. This piece walks through the OAuth consent mechanism, the blast radius it creates, and the inspection-layer controls that constrain the scope after grant.

oauthai-agent-securityconsentnon-human-identityai-engineering
Read post →

AI Red Teaming Workflow: The Test-Fix-Prove Loop for Enterprise AI Deployments

AI red teaming discovers vulnerabilities in prompt handling, tool-call authorization, and response classification. The finding is one artifact. The fix is another. The evidence that the fix works is a third. This piece walks through a red-teaming workflow that produces all three artifacts inside the enterprise control boundary, and the inspection-layer architecture that turns findings into policy the enforcement layer executes.

red-teamingai-securitypenetration-testingai-engineeringai-governance
Read post →

Agent-to-Agent TLS: Mutual Authentication Between AI Agents in a Multi-Agent Workflow

A multi-agent workflow chains AI agents where each agent calls the next over an HTTP transport. The security posture of the chain depends on the mutual authentication between the agents at each hop. This piece walks through the mTLS pattern for agent-to-agent authentication, the certificate lifecycle, and the inspection-layer architecture that binds every agent-to-agent call to a verified identity pair.

agent-to-agentmtlsai-agent-securitymulti-agentai-engineering
Read post →

LLM gateway vs LLM router: what each component does and why the enforcement layer sits in only one of them

The LLM gateway and the LLM router occupy different layers in an AI stack even when a vendor bundles them under one label. The gateway is the identity-aware policy enforcement point that sits between authenticated users and any LLM. The router is the traffic-shaping component that decides which model handles a given request. Confusing the two produces predictable failure modes at audit time. This piece walks through the two components, the fields each layer records, and how the policy decision at the gateway constrains what the router is allowed to route to.

llm-gatewayllm-routerai-architectureai-policy-enforcementai-control-plane
Read post →

The LLM inference gateway: what sits between authenticated callers and the model, and what belongs somewhere else

The LLM inference gateway is the identity-aware policy enforcement point between authenticated users or agents and any model endpoint. It is the layer where authorization, data classification, and audit-record production live. This piece defines the term, walks through the four fields the gateway resolves per request, contrasts it with the inference server, model router, and API gateway it is often confused with, and shows why the audit-write path must be isolated from the caller. Applies to any deployment running an OpenAI-compatible or provider-native LLM API in production.

llm-gatewayllm-inferenceai-architectureai-control-planepolicy-enforcement
Read post →

LLM routing strategies: five patterns for production, and where the policy decision constrains each one

LLM routing strategies decide which model, provider, or endpoint handles a given request. Five patterns cover most production deployments: static routing, cost-optimized routing, quality-tiered routing, latency-budgeted routing, and fallback routing. Each pattern operates on request metadata after the policy decision at the gateway has authorized the request and produced the audit record. This piece walks through the five patterns, what each optimizes for, and the constraints the gateway places on all of them.

llm-routerllm-routingai-architectureai-gatewaymulti-model
Read post →