Security, Governance, and Operations

Trust Boundaries and Governance Controls

Enterprise identity is inherited from ICAM; the Portal does not create identity. The Portal binds authenticated users and groups to workload ownership, model entitlements, quotas, budgets, and scoped credentials. The Gateway consumes that approved state at runtime and enforces the resulting access, routing, and credential-mediation decisions.

Boundary	Control point	Responsibility
Consumer to Portal	Enterprise ICAM and portal workflow	Authenticate users, capture ownership, approve access, and bind workloads to budgets and entitlements.
Client to Gateway	Gateway admission	Validate scoped credentials or workload identity and enforce RBAC, quotas, rate limits, and data-policy rules.
Gateway to backend	Credential mediation and routing policy	Select only eligible healthy backends and prevent applications from receiving backend secrets.
hub to observability	Telemetry and audit pipeline	Export policy, routing, usage, error, and cost signals to operations, security, and finance systems.

These boundaries make governance enforceable rather than advisory: applications use the Gateway path, while the Portal and control plane define who can use which models, under which constraints, and at what cost.

Hybrid Routing and Serving Operations

Enterprise serving owns model runtime, performance, and replicas. Scheduling manages capacity and isolation, while autoscaling bounds and minimums protect service levels. Bounded queues absorb bursts, rejection prevents hidden backlog, and recovery restores service. Gateway demand informs scaling, but serving controls available compute.

For a fully managed/API-based backend, the provider owns runtime infrastructure, recovery, scaling, scheduling, and queues. The enterprise retains approval, workload identity, data rules, provider credentials, budgets, and quotas. Logical contracts govern cross-backend routing, while attribution and audit support fail-closed decisions. Hybrid spillover never transfers those responsibilities.

This line changes operations, not governance. Enterprise-controlled serving exposes capacity and recovery actions directly to operators. A managed destination exposes only lifecycle and service facts available through its contract. In either case, the hub decides whether enterprise policy permits use without claiming control over provider runtime. The distinction keeps incident ownership clear across the enterprise boundary.

Observability, Attribution, and Privacy

Per-request traces connect application latency with backend execution and reliability, attributing tokens and cost to workload owners. Routing, fallback, health, and saturation explain each outcome. Service teams use this evidence for operations and capacity planning. Security and finance use it for audit and show-back. By default, telemetry excludes prompt and response content, minimizes identifiers, restricts access, and applies purpose-specific retention. Content capture requires explicit authorization and lifecycle controls.

Operational evidence does not require routine content capture. A trace can show successful admission, fallback, and rising backend latency using only identifiers and measurements needed for correlation. Operators can separate gateway from serving delay, while finance assigns usage to the accountable workload. Excluding content reduces privacy exposure without removing diagnostic signals.