How Enterprise Reference works
Data flow
- 1People, workloads and agents all authenticate through the IdP. Consent and token policy decide which third-party apps and vendor agents get grants, and each vendor gets its own service account or role (B1, B2).
- 2All model traffic from your own apps and agents passes one gateway with DLP, guardrails and budgets.
- 3The router picks a destination by app tier and DLP findings, and uses data labels where the app supplies them. Unlabeled traffic defaults to the covered route, which costs more.
- 4Public and Internal data can go to frontier APIs. Confidential and Regulated data go to BAA-covered models in your cloud. Self-host only what can't leave the boundary.
- 5Every agent you run calls tools through the MCP gateway with policy: on-behalf-of tokens where the downstream API supports them, credentials from a secrets manager elsewhere, generated code in a sandbox, human approval for risky actions, and a kill switch that revokes agent tokens.
- 6Gateway, router and tool telemetry stream to the SIEM with AI-specific detections.
- 7Data classification (Purview, Cyera, Varonis) labels data at rest. Apps pass those labels to the router; no tool feeds it directly.
- 8AI inventory and posture tools find models, agents, MCP servers, agent credentials and OAuth grants across cloud, SaaS and endpoints, and feed findings to the SIEM. No single tool sees all of it.
- 9Developers and coding agents work under managed settings pushed by MDM, with one-repo tokens and a package firewall. Their model and tool calls use the same gateways, and code ships only through the CI merge gate (B4). Managed settings are strongest for Claude Code; other agents vary.
- 10MDM and EDR on every laptop report AI apps, browser extensions, MCP servers and local agents to the AI inventory, and the EDR's AI module watches prompts in the browser.
- 11People also use AI inside vendor tenants: ChatGPT, Claude and Copilot enterprise tenants, AI features in your SaaS, and agents built in suites. That traffic never touches your gateway, so the controls are SSO, each tenant's admin settings and connector policy, and audit logs exported into the same SIEM (A2, B1).
- 12The AI you ship reuses the same pieces. Product features call models through the gateway, customer agents reach your MCP server through your own OAuth server, and actions go through the toolshed with each customer's tenant ID enforced (C1, C2).
Build or buy
Buy + glueWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| Identity provider | Okta, Microsoft Entra ID (P1 or higher, Entra Agent ID with Agent 365), Google Workspace | Keycloak | Workload identities for custom agents, so no agent runs on a shared API key | GA |
| AI gateway | Portkey Enterprise, LiteLLM Enterprise, Kong AI Gateway, TrueFoundry, Cloudflare AI Gateway with Zero Trust DLP | LiteLLM, agentgateway, Envoy AI Gateway | Virtual keys, budgets and DLP rules. Egress blocks so the gateway is the only path. | GA |
| Classification router | No product routes model calls by data label end to end | LiteLLM routing, agentgateway policy | Route by app tier and gateway DLP findings. Use labels only where the app passes them. Unknown goes to the covered route. | No product |
| Data classification | Microsoft Purview (Purview Suite or E5), Cyera, Varonis | Microsoft Presidio (detection only) | Label taxonomy, auto-labeling rules and data owners | GA |
| AI inventory and posture | Wiz AI-SPM, Orca, Noma, Zenity, Microsoft Agent 365, Purview DSPM for AI | · | One register merging each tool's findings, plus MCP server and agent credential inventory from endpoints | GA |
| Endpoints (MDM + EDR) | Jamf, Iru or Intune; CrowdStrike Falcon Guardian, SentinelOne AI Usage Control or Microsoft Defender for Endpoint | Santa, osquery | MDM scripts that report MCP configs, AI extensions and local agents to the inventory; EDR alerts your MDR acts on | GA |
| MCP gateway and policy | Kong (enterprise), Runlayer, MintMCP, Obot, Cloudflare MCP server portals (for people, not headless agents), Auth0 token exchange | Docker MCP Gateway, Microsoft MCP Gateway, agentgateway | Static tool allowlist first. Then on-behalf-of tokens per downstream API, with vaulted credentials where unsupported. | GA |
| Developer lane | Claude Code managed settings, GitHub Copilot and Cursor org policies, Jamf, Iru or Intune, Socket or JFrog Curation | OSV-Scanner, Renovate | MDM-pushed policy files for each coding agent, one-repo tokens, and a CI merge gate as the only way to ship | GA |
| SIEM and AI telemetry | Microsoft Sentinel, Splunk, Datadog Cloud SIEM | Wazuh, OpenSearch Security Analytics | AI detections: injection hits per user, wrong route, budget spikes, MCP tool abuse, agent tokens used from new places | GA |
| Model tiers | Frontier APIs, Amazon Bedrock, Azure OpenAI or Google Vertex AI under a BAA | vLLM | Keys, evals and capacity for each tier. Self-host only what can't leave the boundary. | GA |
| AI vendor tenants | ChatGPT Enterprise, Claude Enterprise, Microsoft 365 Copilot, Gemini and the AI in your SaaS; Purview Audit and each vendor's compliance or audit API. | · | Audit export jobs into the SIEM and a per-tenant settings baseline. | GA |
| Consent and grant policy | Google Workspace API controls, Entra consent policies and the admin consent workflow, Okta OAuth service apps for vendors; Push Security or an SSPM for grant inventory. | GAM, Maester | An approved-apps list and a quarterly review of vendor access. | GA |
| Your product and API | Auth0, WorkOS or Descope for agent OAuth, behind the same AI gateway and MCP gateway. | · | Tenant ID on every retrieval and tool call, and your MCP server's scoped tools. | GA |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | Inventory models, agents, MCP servers and shadow AI from cloud, SaaS and endpoints | Security engineer | 2-4 weeks |
| 2 | Put every AI tool behind SSO, give agents workload identities and revoke shared keys | Identity engineer | 2-4 weeks |
| 3 | Stand up one AI gateway and block direct provider traffic | Platform engineer | 4-6 weeks |
| 4 | Turn on SSO, admin settings and audit export in every AI vendor tenant, and route new OAuth grants and vendor access through admin approval | Security engineer + IT admin | 2-4 weeks |
| 5 | Push managed settings to coding agents by MDM, add one-repo tokens, a package firewall and the CI merge gate | Platform engineer with IT | 3-6 weeks |
| 6 | Send gateway, MCP and identity logs to a bucket, then to the SIEM with starter AI detections | Detection engineer | 4-8 weeks |
| 7 | Put agents behind an MCP gateway with a static allowlist, then add on-behalf-of tokens for top tools | Platform or identity engineer | 4-8 weeks |
| 8 | Roll out data classification on the main data stores | Security engineer with data owners | 6-12 weeks inside a 6-12 month program |
| 9 | Add the router last: app-to-tier mapping first, then DLP rules, failing safe to the covered route | Platform engineer | 3-6 weeks |
| 10 | Ship customer-facing AI on the same gateway and toolshed, with tenant isolation tested in CI | Product eng + security | Ongoing |
| 11 | Get an outside architecture review and red team | Outside consultant | 3-8 weeks |
What you still build
- The classification router: app-to-tier rules, gateway DLP overrides, fail-safe to the covered route, and an audit log of every decision
- Egress rules and key revocation so the gateway is really the only path
- AI-specific SIEM detections and log parsers for the gateway, MCP gateway and coding agents
- On-behalf-of token setup for each downstream API, and wrappers for MCP servers that only take static keys
- One AI inventory register built from AI-SPM, Agent 365, MDM and IdP data
- Policy files for each coding agent and the CI merge gate
Gotchas
- Prompts don't carry data labels. Purview, Cyera and Varonis label data at rest, so the router has to rely on app tier and DLP findings.
- With labeling incomplete, failing safe sends most traffic to the covered route. That costs more, and covered models can lag new frontier releases.
- No single inventory tool sees everything. Cloud, Microsoft 365, SaaS and laptops each need their own source.
- Many MCP servers don't support per-user OAuth, so on-behalf-of tokens fall back to shared credentials.
- Managed settings coverage varies by coding agent. Personal accounts and unmanaged laptops get around it.
- Most AI detections don't ship with the SIEM. Plan to write your own.
- Full rollout with data classification usually takes 6-12 months, not 3. At 50 people it isn't realistic.
Common use cases
- Org-wide AI platform
- Mixed sensitivity across business units
- Engineering-wide coding agents
- Central AI governance and reporting
Key risks
- Complexity slows adoption and drives shadow AI
- Misclassified data routed to the wrong tier
- Developer tooling outside the control plane
- Router becomes a policy bottleneck
- Vendor tenants and app grants outside the gateway's view
Fast path
- DEFERRouter. Start with two tiers by app
- KEEPOne gateway for all traffic from your own apps and agents
- KEEPSSO, admin settings and audit export on every AI vendor tenant
- KEEPManaged settings and the merge gate for every coding agent
- SIMPLIFYStatic tool allowlist before full policy
- SIMPLIFYTelemetry to bucket first