Enterprise AI governance rarely fails on paper; the issue is enforcement. A platform team can sign off on exactly which models engineering and finance are allowed to touch, set spending limits, and document the entire policy. However, if that policy lives in documents and dashboards rather than in the request path itself, it doesn't really get enforced.
Credentials management further complicates matters. Provider keys are sent out to engineers, analysts, applications, and a growing number of agents, so it's difficult to say who is spending what. Cost control happens after the fact: a recursive tool-calling loop churns quietly for hours, burning thousands of dollars in tokens, and you find out only after the usage has already piled up.
Unexpected invoices are just the tip of the iceberg. Unmanaged model connections increase the organization's AI attack surface, especially as AI systems expand from basic question answering to taking action. Agents commonly read and update data in internal systems and invoke services via the Model Context Protocol (MCP).
Centralized runtime visibility and policy enforcement are needed, as shown in IBM's 2025 Cost of a Data Breach Report, which found that 97% of organizations reporting a breach involving an AI model or application lacked proper AI access controls. Of the 600 organizations, 13% reported an AI-related security incident.
Exposure extends beyond centrally managed applications to include Shadow AI. Verizon's 2026 Data Breach Investigations Report found that 45% of employees in its dataset were regular users of AI on corporate devices, whether authorized or not, up from 15% the previous year. Among users accessing unauthorized GenAI services, 67% used non-corporate accounts on company devices. Shadow AI is now the third-most-common non-malicious insider action in the study's dataset.
Mitigation using traditional infrastructure doesn't provide the necessary AI-specific controls, such as model-aware routing and fallback, token-level budgets, or policies governing which tools an agent may discover and execute. Bifrost, the gateway built by Maxim AI, brings those controls directly into the runtime request path. It unifies more than 20 providers behind a single OpenAI-compatible API, which adds only 11 microseconds of overhead in its published benchmarks at 5,000 requests per second. In most cases, developers only need to change the URL endpoint.
The core gateway and virtual-key controls are open source. Access Profiles, data access control, advanced provisioning, and enterprise MCP Tool Groups are part of Bifrost Enterprise. Bifrost Edge (currently in alpha) extends those controls to AI operations on every supported machine. The model is consistent throughout the product: administrators define policy once, let the gateway enforce it for centrally routed model and MCP traffic, and use Edge to extend the same policy enforcement to employee devices.
Virtual keys, access controls, and user provisioning
With Bifrost, you stop handing raw provider credentials to every team and application. You hand out virtual keys instead. Each key sits between the caller and the provider, and it enforces policies on every call. Policies can include restrictions on which models can be invoked, how much the caller can spend, and how many requests and tokens can be used before throttling occurs.
Adopting Bifrost typically only requires a one-line code change. Point the client at Bifrost's base URL and change the provider credential to a virtual key. Governance controls can be put in place without any architectural changes.
You can also stack controls to match the organization's actual structure. A virtual key can stand on its own, hang directly off a customer, or live under a team beneath a customer, with provider-specific budgets and rate limits nested below the key. Every request runs the whole stack. Blow past a budget at the key, team, or customer level, and Bifrost refuses the request. Burn out one provider's budget or rate limit, and it simply routes around that provider instead of failing the call.
Virtual keys determine what a caller may access, how much it may spend, and how quickly it may consume resources. The remaining enterprise challenge is provisioning and maintaining those controls across hundreds or thousands of individual users. Access Profiles allow you to write a policy once and have it enforced everywhere it applies. An organization might create profiles such as "Engineering", "Finance", or "Contractor." These profiles can be assigned directly to users or attached to organizational roles. Every user receives the same policy but accumulates usage independently under the budget controls. When project requirements evolve, administrators update the central template rather than tracking down individual keys or editing user accounts one by one.
Bifrost Enterprise plugs into your identity provider and keeps user and group assignments in sync with it. Whatever your identity provider already knows about a person (e.g. their claims, app roles, group memberships, and other attributes) maps straight onto Bifrost roles, teams, and business units. Onboarding a whole group at once? Admins can preview and bulk-import users in a single pass.
When people change roles or leave the organization is often where things go wrong. Provider keys get pasted into a local .env file and stay valid for months after the person should have lost access. Alternatively, revoking a shared credential risks breaking multiple applications. Bifrost addresses these issues by decommissioning individual users and running scheduled reconciliations to identify stale accounts.
RBAC and data access controls govern who can administer the gateway
To keep a shared AI gateway secure, you have to draw a sharp line between two distinct operational domains: the runtime plane (where your AI traffic flows) and the management plane (where your human operators work). While Virtual Keys and Access Profiles govern what your applications and autonomous agents are allowed to execute at runtime, Role-Based Access Control (RBAC) and Data Access Control (DAC) govern who can see and manage the gateway itself.
The split is easiest to hold as two questions. RBAC asks βwhat can you do?β, such as view telemetry, issue virtual keys, change a guardrail. DAC asks βwhose data can you touch?β Every admin role gets exactly one data scope (own-data, team-data, or all-data) and Bifrost filters every view against it. When a finance manager signs in, engineering's and HR's keys, prompts, and logs don't appear locked; they simply aren't there. It keeps internal chargebacks clean, too. Each cost center tracks its own token burn without ever bumping into another team's budget. This enables a dozen different departments to share one high-performance Bifrost cluster and maintain compliance. An auditor can work through one business unit's telemetry without touching company-wide logs.
MCP Tool Groups govern what agents can do
Governing actions matters more than governing text. Once agents move past answering questions and start reading and writing against real systems, one wrong tool call carries a real blast radius. Defining which tools an agent can reach becomes as important as which model it calls. Bifrost does this by acting as a Model Context Protocol (MCP) gateway to control which tools agents can discover and execute.
At the virtual-key layer, MCP tool filtering provides a strict allow-list. A key with no MCP configuration receives no tool access, and configured restrictions are enforced when tools are exposed to the model and when an execution request arrives. Bifrost Enterprise adds reusable MCP Tool Groups to simplify the management of this capability.
Bifrost Edge extends governance to user devices
Even the best gateways have a blind spot: AI traffic that they never see. If an engineer uses Cursor, Claude Desktop, or a local coding agent connected to an unmanaged MCP server, the central gateway can't enforce the policies. This is where Bifrost Edge comes into play. It enforces AI governance to supported applications and MCP servers on employee devices. Its endpoint agent routes traffic through Bifrost without requiring users to change their base URLs or reconfigure applications. All of the budgets, rate limits, and audit logging then apply to AI activity originating on the device.
Edge also gives administrators a fleet-wide view of supported applications and configured MCP servers, with controls to allow or block them on the device. Bifrost Edge runs on macOS, Windows, and Linux. It is currently in alpha and supports a growing catalog of desktop applications, browser-based AI tools, and coding agents.
One policy, consistently enforced
Bifrost connects identity, policy, and enforcement across the employee lifecycle. Access Profiles provision users with governed virtual keys used to enforce models, budgets, rate limits, and MCP permissions. RBAC and DAC restrict who can administer the controls; and Bifrost Edge extends enforcement to supported endpoint AI traffic. When a user leaves, identity provider deactivation removes their Bifrost access and allows associated credentials to be managed centrally.
The result is one control plane for AI traffic that would otherwise be fragmented across provider keys, applications, and employee devices. Its access controls, guardrails, scoped administration, and audit trails can support security and compliance programs including SOC 2, ISO 27001, GDPR, and HIPAA.
Explore the full governance model in the Bifrost documentation
Top comments (0)