bitweis

Routing requests to compliant infrastructure covers where the model runs. With ITAR there is still the question of who inside the company gets to see the answer. Export rules apply to foreign persons, including employees working in the US (the deemed export case). So if an agent can pull controlled technical data through a tool call or a retrieval step, a non-US-person engineer who asks the right question gets it back, whichever endpoint served the request.

Do you pass user attributes like US-person status or program access through the gateway, so retrieval and tool calls can be filtered per request? Or is that expected to live in each customer's own systems?

I work at Permit, which builds authorization tooling, so this is the part I always end up asking about.

too quick man, it's a key feature:

https://www.permit.io/rebac

Permit.io

Scales both on the tech, and on the human side - e.g. your product manager can add roles (with CI approval) without requiring engineering involvement.

(I'm biased but still true)

With Both Aserto and Styra gone - there aren't any commerical/enterprise options to get capabilities and support around OPA.

Has anyone seen more options?

100% - it's really about context aware policies for each type of agent, server, interaction, etc. That's why fine-grained policies are such a big part of the answer here

100% - especially when Auth stands for just Authentication. Simple RBAC authorization also won't take us far. But Fine-grained Permissions(e.g. OPA, Cedar, OpenFGA, Permit.io) with ReBAC giving ai-agents Zero standing permissions, and only deriving on the fly the least privilege they need / got consent for, can dramatically reduce the problem