Reference case

dev · us-east-1
Reference cases / S09SyntheticExpert reviewed

AI gateway vendor's admin console governs every model the firm uses

Organization
Halden & Marsh LLP
Vendor / dependency
GateKeep AI Gateway
Industry
Generic business
Headline dimension
6.1 Centralized control plane / admin console
Expert headline · class 6
7.4HIGH
Who's holding the steering wheel?38 agent calls against Amazon Bedrock, five to ten minutes. The expert reading is never sent to the pipeline.

Description

What the agents read

Halden & Marsh LLP, a 900-person professional-services firm, routes all of its generative-AI usage through GateKeep, a single AI gateway product from a specialist vendor. The gateway fronts three model providers, enforces the firm's usage policies, holds the API keys for every provider, applies the firm's data-loss-prevention rules and provides the audit log the firm relies on for client-confidentiality assurances.

Administrators configure routing rules, policies and key rotation in GateKeep's hosted console. The console and its configuration store are hosted in a jurisdiction different from the one the firm chose for inference, a fact the firm discovered when reviewing GateKeep's subprocessor list. GateKeep can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year with release notes published on the day of change. If the console were unavailable or its configuration altered, every AI workload in the firm would be affected simultaneously; the firm has no offline copy of its routing and policy configuration and rebuilding it with another gateway would take a significant project.

Expert reading by hazard class

For comparison after a live run; never sent to the pipeline

ClassCarried byScoreRating
1 Whose AI brain is this, really?1.1 Model hosting location / jurisdiction2.4LOW
2 What are we feeding it?2.1 Prompts / user inputs4.8MEDIUM
3 What does it create from our data: and where does THAT go?3.5 Telemetry / usage logs6.6MEDIUM
4 Who's deciding what the AI sees and does?4.4 Guardrail / safety filter layer6.1MEDIUM
5 Which humans are actually looking at our stuff?5.3 Support / debugging access5.3MEDIUM
6 Who's holding the steering wheel?6.1 Centralized control plane / admin console7.4HIGH
7 How many companies are really in this chain: and did we agree to it?7.1 Downstream subprocessors7.4HIGH

Findings

Expert 'what we found' per class, with the vector each score is computed from

  1. 1 Whose AI brain is this, really?

    1.1 Model hosting location / jurisdiction
    LOW2.4

    The firm chose three model providers and the regions they run in, and GateKeep routes to them as configured. Provider model changes reach the firm on the providers' schedules, but the firm can pin versions per route. No single model is a dependency the firm could not swap.

    The models are where the firm put them and can be swapped; the gateway, not the models, is the dependency.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:M/IR:H/AR:H/R:U/V:C · Low

  2. 2 What are we feeding it?

    2.1 Prompts / user inputs
    MEDIUM4.8

    Every prompt from every lawyer and consultant passes through GateKeep before reaching a model, including client names and matter details that the data-loss-prevention rules are meant to catch. GateKeep logs prompts for 90 days in the console's jurisdiction, not the inference jurisdiction the firm selected.

    All of the firm's prompts pass through, and rest at, a single vendor in a jurisdiction the firm did not pick.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/CR:M/IR:H/AR:H/R:U/V:C · Medium

  3. 3 What does it create from our data: and where does THAT go?

    3.5 Telemetry / usage logs
    MEDIUM6.6

    The audit log the firm shows clients to evidence confidentiality controls is generated and stored by GateKeep. It records who used which model on which matter and when. The firm has no independent copy; if GateKeep's log were altered or unavailable, the firm's assurance to clients would rest on nothing.

    The firm's proof of confidentiality is a record it does not hold.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:M/IR:H/AR:H/R:U/V:C · Medium

  4. 4 Who's deciding what the AI sees and does?

    4.4 Guardrail / safety filter layer
    MEDIUM6.1

    The data-loss-prevention and content rules are enforced by GateKeep's filter engine. The firm writes its own rules, but GateKeep ships default rule-pack updates to all tenants at release time, and a change in how the engine interprets a rule changes what leaves the firm.

    The firm writes the rules; the vendor decides what they mean, and can change that overnight.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N/E:P/CR:M/IR:H/AR:H/AU:Y/R:U/V:C · Medium

  5. 5 Which humans are actually looking at our stuff?

    5.3 Support / debugging access
    MEDIUM5.3

    GateKeep support can open prompt logs, including client and matter details, to investigate a ticket, under a standard support clause. Access is not reported to the firm.

    A vendor engineer can read privileged prompts when a ticket is open.

    SOV:1.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:M/IR:H/AR:H/R:U/V:C · Medium

  6. 6 Who's holding the steering wheel?

    6.1 Centralized control plane / admin console
    HIGH7.4

    The console holds the firm's routing rules, policies and every provider API key, in a jurisdiction the firm did not choose. GateKeep changes console behaviour and defaults for all customers at once and has done so twice this year with same-day notice. If the console failed or its configuration were altered, every AI workload in the firm would stop or misroute at once, and the firm has no offline copy of the configuration to rebuild from.

    One vendor's console is the single switch for every AI workload the firm runs, and the firm holds no copy of what is on it.

    SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:P/CR:M/IR:H/AR:H/S:N/AU:Y/R:U/V:C/RE:H/U:Amber · High

  7. 7 How many companies are really in this chain: and did we agree to it?

    7.1 Downstream subprocessors
    HIGH7.4

    The chain is GateKeep, three model providers and their clouds, plus GateKeep's own hosting provider for the console: at least six companies, one contract. The firm chose the providers, but GateKeep holds the keys to all of them and can add or drop providers for all customers. Every workload depends on every link.

    The firm sits at the top of a chain it did choose, but cannot see or hold the keys to.

    SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:H/E:P/CR:M/IR:H/AR:H/R:U/V:C · High

What the organization should do next

  1. Export the routing and policy configuration on a schedule to firm-held storage, and rehearse rebuilding it on a second gateway.
  2. Move provider API keys into the firm's own secret store, or require GateKeep to hold them in the inference jurisdiction under firm-managed encryption.
  3. Stream the audit log to firm-held storage in real time so client assurances rest on a record the firm holds.
  4. Negotiate advance notice of console, default-policy and rule-engine changes, with a right to defer them.

Questionnaire answers

22 of 22 answered · these seed the metric priors

Show all 22 answers
OP-CRHow damaging would unauthorized disclosure of the data this AI dependency handles be for your organization?Moderate: internal business data
OP-IRHow damaging would an undetected change in this dependency's behaviour or outputs be?Severe: outputs drive automated actions, regulated decisions or safety-relevant processes
OP-ARHow long could your organization operate acceptably without this AI capability?Hours or less: critical path for operations or customers
CL-CATEGORYWhich taxonomy category best describes the dependency you are assessing?Control plane: admin console, IAM integration, API gateway, policy management
D-AVWhere does this dependency run, and who can reach it?In the vendor's own cloud, reached directly over its API
D-ACWhat would the vendor, a subprocessor, or a legal authority have to overcome to access the data or change the service?Nothing beyond its standard terms of service or routine legal process
D-ATCan the vendor exercise this control at any time, or only when something specific happens?At its discretion, at any time (standing right under the contract)
D-PRWho is in a position to exercise this control?Only the primary vendor we contract with
D-UIDoes the exposure require any action by your organization?None: the vendor or subprocessor can act unilaterally
D-VCAt this dependency itself, how much confidentiality could be lost?Partial: limited or indirect exposure (metadata, fragments, aggregates)
D-VIAt this dependency itself, how much could its behaviour or outputs be altered without your knowledge?Full: behaviour can be changed silently and materially
D-VAAt this dependency itself, could the capability be withdrawn or degraded by the exercising party?Full: the capability can be removed outright
D-SCBeyond this dependency, how much confidentiality could be lost at other systems or parties?Partial
D-SIBeyond this dependency, could downstream systems or decisions be altered?Full: downstream systems act on altered outputs without detection
D-SABeyond this dependency, what would stop working, and could anyone be harmed?Downstream workloads stop
D-EHas this kind of control actually been exercised against organizations like yours?Demonstrated in research or incident reports, not confirmed against our stack
D-RIf the vendor relationship ended tomorrow, could you reconstitute this capability elsewhere?Yes, with manual migration effort (re-embedding, re-integration, re-contracting)
D-VHow many of your AI workloads depend on this component?Many or all: shared control plane, gateway, identity or embedding store
D-SWould a loss of control here, on its own, trigger a reportable regulatory violation?No
D-AUCould the loss event happen to all of the vendor's customers at once, with no case-by-case decision?Yes
D-REHow much effort would it take to exit this dependency or otherwise mitigate the exposure?High: re-architecture, re-contracting or physical infrastructure replacement
D-UHow does the vendor notify you of sovereignty-relevant changes (model versions, subprocessors, hosting, terms)?Disclosed at the time the change takes effect

Notes: Expert reviewed. Primary vector derived from the questionnaire answers; category vectors and findings confirmed on review.