Binding is checked, not assumed
An AI Session is bound to one Gateway. The gateway re-checks that the session, the Gateway and the target client agree on every protected operation. A mismatch is a refusal.
Architecture
One security boundary per client, end to end.
For your CTO, your security lead, or your client’s reviewer: what each component does, and where each check happens.
Illustrated concept
One session. One client.
View full size ↗Each client has a separate gateway, vault, policy and audit record. The session’s client binding is checked before a protected operation runs.
Conceptual view of client isolation. The component table below explains where enforcement happens. Explore enforcement →
Enforcement
Where each check happens
Live requests are checked in the client’s own gateway, not in a central service.
| Component | What it does | Access to client credentials |
|---|---|---|
| AAG control plane | Sets up agencies, clients and gateways, and holds credential metadata. | No. Its service identity has no access to credential storage. |
| Credential intake | Accepts a credential once, through a single-use authorization, and stores it encrypted with a dedicated key for that gateway. | Writes only. |
| Client gateway | Binds each session to one client, checks permission for the exact operation before it runs, and records the decision — including refusals. | No. |
| Connector executor | Runs a permitted operation against the client’s provider account and returns the result. | Reads only its own client’s credential. |
| Audit record | A hash-chained record of access decisions, queryable within one client’s scope. | No. |
Credential custody
Give the AI capability while protecting the credential.
Illustrated concept
Credentials stay behind the client boundary
View full size ↗A credential owner authorizes a connection. Credential material is stored encrypted with a dedicated gateway key, and the client’s connector executor uses it to make an allowed provider request. The AI receives the result.
Conceptual custody view. CMEK refers to gateway keys managed in Cloud KMS, not a claim that the end client owns the key. Provider and AI logos are examples; the diagram’s audit language does not establish complete audit coverage. Check named integration status →
Explore the expanded illustration
The credential lifecycle covers intake validation, encrypted storage and controlled rotation. Credential values are withheld from AI applications; the authorized connector executor still retrieves and uses them for provider requests.
Expanded design concept. “Credentials never leave” means they are not exposed to the AI, not that the executor never uses them. Audit and enterprise wording is not a certification or a completeness guarantee.
View expanded illustration full size ↗Properties
What the design is built to hold
Authorization precedes execution
Policy and permission evaluation happens before any provider or network call. An authorization snapshot carries an expiry; an expired snapshot refuses rather than proceeds, and the refusal is recorded.
Credential material stays behind the boundary
Credentials are submitted through a single-use intake and stored encrypted with dedicated gateway keys managed in Cloud KMS. This does not imply the end client owns or operates the key. The database and control plane hold metadata only. The connector executor retrieves the secret under its own service identity, not the AI’s.
Failure is closed by default
Invalid, expired, cross-client and revoked cases all resolve to refusal. The safe outcome does not depend on a check succeeding.
Evidence is chained
Audit records are hash-chained so that the sequence of decisions is tamper-evident, and they can be queried within a client’s scope.
Isolation extends to infrastructure
Each client’s gateway is designed to run in its own cloud project with its own runtime identities, provisioned by infrastructure-as-code with reviewed plans.
Lifecycle and revocation
Offboarding is a security feature
Most access incidents are not dramatic. They are an account that was never turned off. Operators can suspend, retire anddestroy a gateway, rotate orrevoke a credential, and disable orre-enable a connector.
After committed revocation propagates, subsequent requests are refused. The documented propagation bound is 30 seconds from a committed change; this is not instant revocation. Already-admitted requests can complete, and revoking access does not erase existing model context. Destroying one client’s gateway leaves the other clients’ gateways in place.
When a client leaves, access stops and the record of what happened is retained.
Model
The objects you will be reasoning about
A security review goes faster when both sides use the same nouns.
Show the ten objects
- Agency
- Your organisation — the ownership boundary everything else sits inside.
- Agency Client
- One of your clients. The unit that must stay isolated from every other.
- Gateway
- The AAG security boundary belonging to exactly one Agency Client. Holds that client’s credential bindings, permissions, policy and audit history.
- AI Principal
- An authenticated AI identity. Authorization is bound to this, not to a model brand.
- AI Session
- A live AI working session. Bound to exactly one Gateway for its lifetime.
- Human Session
- A revocable session for a person on your team, established after identity verification.
- Connector Instance
- A configured connection to one external system for one client.
- External Account
- The client’s account in a downstream provider.
- Credential Binding
- The metadata link between a Gateway and stored credential material. The binding is visible; the secret is not.
- Audit Event
- The attributable record of an access decision and its outcome.
Bring your architecture questions
A hard review early is better than a blocker late.