Boundaries: Retrieval, Gateway, Identity, and Containment
Explore how to design and enforce trust boundaries in AI systems by strategically placing retrieval, gateway, identity, and containment controls. Understand how to manage delegated identities, enforce permission-aware retrieval, and implement policy checks to secure data and actions. This lesson guides you to produce clear diagrams and specifications that demonstrate system safety, compliance, and audit readiness.
The ADR set from the last lesson names the minimum sufficient step and the controls it requires. This lesson places those controls at the boundaries where they can enforce policy. A coherent enterprise boundary design separates policy intent from enforcement points, then maps both into a single reviewable trust-boundary view. Policy intent may initially exist only as a statement, such as, “The system must not exfiltrate regulated data.” If the design never identifies the specific components that can block, rate-limit, require approval for, or audit a request, control gaps may remain hidden until an incident, audit, or investigation exposes them.
This step defines the placement of four controls that must operate together. That placement determines where untrusted content can enter the system, where identity is established and delegated across service boundaries, where retrieval permissions and entitlements are enforced, and where high-impact tool actions are blocked, constrained, or routed for approval within the agent containment envelope. The result should be captured in a single set of diagrams and specifications within the capstone integration and security package. The package should show who performed each action, under whose authority, using which data, through which enforcement point, and what system behavior followed when a control failed closed.
End-to-end trust boundaries and identity propagation
A defensible end-to-end boundary view names the trust zones and the crossing points. Typical zones in this capstone shape include a user zone, an application or orchestrator zone, an AI gateway zone, and separate zones for retrieval, tool servers, and systems of record. Each crossing point carries a required identity context and a policy enforcement responsibility, so the gateway, retrieval layer, and tool layer never each assume the others already checked something.
The data flow works as two coupled paths sharing the same delegated identity. The first path is conversational inference, where the orchestrator calls an AI gateway and the gateway routes to one or more model endpoints. The second path is augmentation and actions, where the orchestrator calls a retrieval service and MCP tool servers, which in turn touch systems of record. Delegated identity travels with both paths as an explicit principal context, along with tenant context, session context, and an authorization decision reference that can be audited later without storing the ...