The questionHow do we stop the wrong team reaching the wrong data?
Authorisation is enforced at the reverse proxy. The gateway evaluates the authenticated identity's domain permissions before any downstream service is contacted, so an engineer without finance access is refused before the agent layer runs and before any query touches the finance database.
What we can evidence
Refuse an unauthorised request before the agent layer runs.
The gateway evaluates domain permissions attached to the authenticated identity before contacting any downstream service. An optimisation engineer without finance access receives a no-access response at the gateway — the agent is never reached and no query touches the finance database.
Change permissions without a redeploy.
An admin console provides per-user, per-domain grant management at checkbox granularity, with changes taking effect immediately. Agent tools are scoped per pipeline as a second layer, so each domain's assistant carries only the tools, and therefore only the data reach — of its domain.
Attribute every action to a real identity.
SSO via OIDC, brokered through Keycloak to Microsoft Active Directory or an equivalent enterprise IdP, gives one identity across every platform surface. Every interaction is attributed to that identity, producing an audit trail that satisfies enterprise security review and supports regulatory audit obligations.
Why the enforcement point matters more than the rule
Most access control in analytics tooling is applied inside the application — the query runs, the results are filtered, and correctness depends on every code path remembering to filter. Enforcing at the reverse proxy inverts that: the boundary is applied consistently regardless of how the request originated, and a new feature cannot accidentally bypass it because it never sees the request. The rule is easier to audit because there is one place to look.
Two layers, deliberately
| Layer | What it enforces | Failure mode it prevents |
|---|---|---|
| Gateway authorisation | Which data domains an identity may reach at all | A user reaching a pipeline they were never granted |
| Per-pipeline tool scoping | Which tools, and therefore which data — each assistant carries | An authorised user's assistant reaching further than the domain requires |