DEV Community: Fabio Matricardi

Best AI Security Platforms for Enterprises

Fabio Matricardi — Wed, 07 Oct 2026 13:03:00 +0000

The five platforms securing enterprise AI, and why Bifrost is the strongest foundation for control, security, and independence.

One in four malicious breaches is now AI-enabled. IBM’s 2026 Cost of a Data Breach Report puts a number on what security teams already feel: AI-driven attacks jumped 56% in one year, and they cost $6 million on average. This is a full million above the $4.99 million global average. And this opens a critical review on the state of the art of AI security platforms.

IBM and the Ponemon Institute released the 2026 Cost of a Data Breach Report on July 2026, the 21st edition of a study that has tracked breach economics since 2005. The global average cost of a breach climbed to USD 4.99 million, a 12% jump over last year and a new record. That number will lead most of the coverage. It shouldn’t. The number that matters is buried on page 40: 92% of organizations that experienced an AI-related security incident lacked proper AI access controls when it happened. (ref Kitework).

The 2025 report highlighted that sixty‑three percent of organizations have no formal AI governance policy, or are still writing one.

The attack surface is wider than the security team knows, and this is where an AI security platform kicks in.

So enterprises are buying… fast. But the market’s answer was nothing but a consolidation.

Palo Alto Networks bought Protect AI, Check Point bought Lakera, and F5 bought CalypsoAI.

Which raises the only question that matters:

do you want a suite you rent, or a control plane you own?

I ranked the five AI security platforms below against exactly that question.

1. Bifrost, the control plane you own

Bifrost is an open-source AI gateway written in pure Go by the team at Maxim. A gateway acts as a central control point positioned between your applications and your model providers, whether that is OpenAI, Anthropic, Bedrock, or a local llama.cpp instance in your server room. It manages, routes, and secures all outgoing and incoming AI requests through a single unified hub.

Instead of scattering raw provider keys across your cluster, Bifrost issues Virtual Keys: scoped identities per developer, team, or customer. Your real credentials stay inside a vault (HashiCorp Vault, AWS Secrets Manager) decrypted in memory, never written to disk.

Then the governance kicks in. Hierarchical budgets cap spend at key, team, and customer level.

Dual-axis rate limits (requests and tokens per minute) prevent a single malfunctioning agent loop from rapidly consuming your entire API allocation. Integrated Single Sign-On (SSO) via Okta or Microsoft Entra ID directly links enterprise user identities to specific model access permissions.

The security heart is in-flight guardrails: PII (personally identifiable information) redaction before a prompt leaves your network, secrets detection that blocks leaked credentials, schema validation on agent responses, plus custom rules in plain CEL (Common Expression Language: think “if-this-then-block” assertions).

Routing policies can forbid sensitive data from reaching an unapproved public model. The request dies at the gateway, and the violation gets logged.

MCP (Model Context Protocol), the standard that lets agents call external tools, gets scoped too. Unauthorized tools are stripped from the catalog before the model even sees them. An agent that cannot know a delete command exists cannot fire it.

It runs air-gapped inside your own VPC (Virtual Private Cloud, your private network slice in the cloud), with immutable audit logs streaming to S3 or Kafka. Every request logs the originating key, the exact model, the cost, the redacted PII, and every MCP tool call.

Overhead: under 15 microseconds per request. In sustained 5,000 RPS benchmarks, Bifrost adds 11 µs of overhead per request, 50x faster than LiteLLM.

Let’s talk about security: Bifrost covers prompt-injection defense too, with prompt guardrails and a documented Check Point AI Agent Security integration.

There is one more gap it closes: Bifrost Edge. Developer laptops are the unmanaged perimeter: an IDE pointed straight at a provider bypasses every central rule.

Edge runs as a background agent on macOS, Windows, or Linux and routes local traffic through the gateway, budgets, redaction, and tool filters included. And you can test all of it today: npx -y @maximhq/bifrost brings up the dashboard in under a minute.

👉 Best for enterprises running mission-critical AI workloads. Choose Bifrost first if you want an AI control plane you can inspect, customize, and run inside your own perimeter. It centralizes identity, routing, budgets, guardrails, MCP permissions, and audit trails without locking your architecture to one model provider or security vendor. Add specialist platforms only where their deeper lifecycle or detection capabilities justify another layer. Book a Bifrost Enterprise demo to see how it fits your environment.

2. Lakera, real-time prompt defense, now a Check Point company

Lakera was founded in 2021 by ex-Google and Meta researchers, dual-headquartered in Zurich and San Francisco, and raised a $20 million Series A led by Atomico ($30 million in total) before the inevitable happened. Check Point announced the acquisition on September 16, 2025, and closed it on October 22, 2025.

What you are actually buying: Lakera Guard (real-time runtime enforcement) and Lakera Red (red teaming, simulated attacks run against your AI). Both defend LLMs (large language models), agents, and multimodal workflows across prompts, RAG (Retrieval-Augmented Generation, your model answering from your documents), and MCP traffic.

Check Point’s numbers: above 98% detection, sub-50-millisecond latency, false positives below 0.5%, coverage in over 100 languages, backed by a research team of 11 PhDs and, per Check Point, a customer list heavy with Fortune 500 names.

Beyond the runtime, the platform covers workforce security too: shadow AI discovery across apps and browsers, context-aware data protection in prompts, and granular policies per user, app, and action. Pre-deployment red teaming and runtime enforcement are designed as one loop: test it, then watch it.

The secret weapon is Gandalf: a public game where a million-plus users have collectively fed the platform over 80 million adversarial attack patterns. Your guardrails learn from the crowd.

👉 Choose Bifrost first when you need the central enforcement point for model access, identity, routing, budgets, and MCP tools. Add Lakera when real-time prompt-injection defense, agent behavior protection, multilingual detection, or pre-deployment red teaming deserves a dedicated specialist layer. The practical combination is Bifrost as the traffic and policy control plane, with Lakera strengthening detection at the application and agent boundary.

3. Protect AI, the full-lifecycle suite, now Palo Alto

Palo Alto Networks announced its intent to acquire Protect AI on April 28, 2025, and completed it on July 22, 2025. Protect AI now lives inside Prisma AIRS, Palo Alto’s AI security platform.

The capability list is formidable:

AI Model Scanning: 35+ file types across 25+ threat categories. Backdoors, data poisoning, malicious code hiding in third-party models.
Posture Management: watches your AI estate for misconfigurations.
AI Red Teaming: 500+ attacks, run autonomously and continuously.
Runtime Security: blocks prompt injection and data leaks in flight.
AI Agent Security: covers identity impersonation, memory manipulation, and tool misuse.

The timeline matters. Prisma AIRS 2.0 (October 28, 2025) completed the native Protect AI integration.

Prisma AIRS 3.0 (March 23, 2026) moved to the agentic lifecycle: agent discovery across cloud, SaaS, and endpoints, artifact scanning, and an AI Agent Gateway (currently in limited preview) as the control plane for agent identity and runtime enforcement.

Honest trade-off: this is a platform sale. You buy breadth. You also buy a roadmap you do not control.

Two details worth knowing. Model scans run in your environment, so proprietary weights never leave your control. This is an argument that lands hard with legal, not just security.

And threat detection is fed by Palo Alto’s WildFire intelligence plus the ethical-hacker community, validating models against millions of already-scanned artifacts.

👉 Choose Bifrost first when your immediate need is to govern live AI traffic across providers, applications, users, and agents. Add Protect AI through Prisma AIRS when you also need deep model-artifact scanning, AI supply-chain analysis, continuous red teaming, and broader Palo Alto Networks integration. Bifrost controls what reaches production; Prisma AIRS helps validate what enters the environment and monitors the AI estate around it.

4. HiddenLayer, the independent with model depth

HiddenLayer was founded in Austin, Texas, in 2022, and on September 2026 it announced a $100 million Series B led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, M12 (Microsoft’s venture fund), and Booz Allen Ventures. Revenue grew more than 10x in a year; 50+ new platform customers signed.

The platform runs on four modules: AI Discovery (find shadow AI across your environments), AI Supply Chain Security (validate model integrity before deployment), AI Attack Simulation (continuous adversarial testing), and AI Runtime Security.

In March 2026 it went agentic: session-by-session visibility into how autonomous agents behave, threat hunting across execution paths, and real-time enforcement that redacts data and blocks unauthorized actions mid-workflow.

A companion module, Agent Harness Security, targets AI coding agents directly. Their 2026 threat report claims one in eight AI breaches is now linked to agentic systems.

Why it matters: no firewall division to feed. Model scanning is the core product here, not a checkbox on a suite roadmap.

The platform is built on patented technology and adversarial AI research, sells into financial services, healthcare, and US federal buyers, and runs on partnerships with AWS and Databricks. GitLab’s CISO is on record calling the technology elegant: rare praise from a buyer whose own product ships AI.

👉 Choose Bifrost first if you want a vendor-independent gateway for governing AI access and enforcing policy in production. Consider HiddenLayer when model integrity, AI supply-chain security, adversarial testing, or agentic runtime visibility is the harder problem to solve. HiddenLayer can deepen assurance around models and agents; Bifrost remains the place where enterprise policy is applied to the traffic those systems generate.

5. CalypsoAI, inference-layer guardrails, now F5

The inference layer (where AI actually spends your money) finally got a bouncer.

CalypsoAI was founded in Silicon Valley in 2018 with major operations in Dublin. It was a 2022 Gartner Cool Vendor, a top-two finalist in the 2025 RSAC Innovation Sandbox, and it counts Palantir among its customers.

Funding history: a $23 million Series A-1 led by Paladin Capital Group with Lockheed Martin Ventures, over $40 million in total.

F5 announced its acquisition on September 11, 2025 at $180 million in purchase consideration, and closed it on September 26, 2025, with F5’s own SEC filing recording $145.2 million in cash paid at close.

Post-close, the products emerged as F5 AI Guardrails (runtime security for models and agents) and F5 AI Red Team, both integrated into F5’s Application Delivery and Security Platform (ADSP: F5’s umbrella for delivering and securing apps, APIs, and now AI). Red Team maps where AI failures are most likely and most damaging, so you know where the guardrails must go first.

The focus is the inference layer: guardrails that adapt as models change, centralized observability and audit logs aimed at GDPR and EU AI Act compliance, and protection that stays model- and cloud-agnostic.

Why does that matter? Because, as F5’s CEO argues, enterprises must retain independence from any single AI model or hosting provider. That is a gateway argument made by a firewall company.

👉 Choose Bifrost first if you need a neutral AI gateway that can govern traffic across clouds, model providers, applications, and local deployments. Choose CalypsoAI through F5 AI Guardrails when your organization already standardizes on F5 and wants inference-layer protection integrated into its existing application-delivery and security stack. In that case, Bifrost can remain the cross-provider control plane while F5 protects the application edge.

AI security platform: recap

Security that audits itself, gates every token, scopes every tool, and never leaves your network — or security that ships in a bundle with your firewall renewal.

Lakera: Check Point announced the acquisition on September 16, 2025; the transaction closed on October 22, 2025, making Lakera the foundation of Check Point’s AI-security Center of Excellence.
Protect AI: Palo Alto Networks completed the acquisition on July 22, 2025 and positioned it as a cornerstone of Prisma AIRS.
CalypsoAI: F5 announced the $180M acquisition on September 11, 2025 and completed it on September 26, 2025; its capabilities became F5 AI Guardrails and F5 AI Red Team within ADSP.
HiddenLayer: It remains independent and raised a $100M Series B on September 2, 2026, with stated investment in agentic runtime security and AI coding-agent protection.
Bifrost: It remains vendor-backed open source from Maxim AI / H3 Labs, under Apache 2.0; enterprise capabilities such as clustering, RBAC, SSO, audit logs, and some guardrail features are separately licensed.

Lakera, Protect AI, and CalypsoAI are now capabilities inside larger security vendors’ platforms, so their evolution will be shaped by Check Point, Palo Alto Networks, and F5 respectively. The real procurement question is not “which product has the best demo?” but where the policy, telemetry, enforcement point, and exit path live.

A suite can simplify vendor management; an independently deployable control plane such as Bifrost preserves more architectural autonomy, though it shifts operational responsibility to your team.

Conclusions

The enterprise AI Security Platform market is consolidating quickly. Lakera, Protect AI, and CalypsoAI now offer serious capabilities, but as components inside larger security portfolios, their roadmaps, packaging, and deployment models are no longer entirely yours to influence.

That makes Bifrost the most compelling choice for organizations that want control at the point where AI traffic actually moves.

Bifrost is not another isolated scanner or a security dashboard added after deployment. It is the control plane between your people, applications, agents, tools, and model providers. Every request can pass through the same gateway, where your team can apply identity-aware access policies, budgets, rate limits, guardrails, routing rules, MCP controls, and audit logging.

That architectural distinction matters. You can change models without rewriting every application. You can move between cloud providers without distributing new credentials. You can keep sensitive traffic inside your own perimeter. And because the core is available under the Apache 2.0 license, you retain an exit path rather than placing your entire AI-security strategy inside another proprietary platform.

The trade-off is responsibility. Bifrost gives your team more ownership, but ownership means designing the policies, operating the gateway, and deciding which controls belong at the network, application, identity, and model layers. For organizations that want a managed security suite, one of the incumbent platforms may be simpler. For organizations that want a durable enforcement point they can inspect, extend, and run privately, Bifrost is the stronger foundation.

> Bifrost is the best choice if you want to route, govern, and secure AI traffic without giving up architectural independence.

See how it fits your environment: book a Bifrost Enterprise demo with a Bifrost engineer. Walk through your model providers, identity stack, agent workflows, MCP tools, deployment requirements, and governance policies: and see where Bifrost can become the control plane your AI estate is missing.

Your AI. Your rules.

Referenced Sources:

AI Enterprise Governance: Implementing Runtime Controls at the AI Gateway

Fabio Matricardi — Mon, 03 Aug 2026 11:44:17 +0000

Why static security policies fail for generative AI, and how Bifrost enforces real-time budgets, guardrails, and role-based access across your entire model footprint.

If you have been following my journey through local AI engines, terminal coding assistants, and the world of Model Context Protocol (MCP), you know how fast this ecosystem moves.

What has been happening in the past few weeks, though, is changing once and for all the public alert sentiment on the risks of running AI agents. We saw data leaks, encryptions broken, deleted production database and privacy concerns.

The attention and alert level has never been so high: in fact, once an organization moves past individual experimentation and starts deploying agents across dozens of departments, a new bottleneck emerges.

It is no longer a matter of making agents work. It becomes a game of keeping them inside safe operational boundaries.

We need new rules for the AI agency storm

A few weeks ago, I spoke with an IT director at a financial technology firm. Their engineering team had deployed internal coding assistants, customer support agents, and document search pipelines across three separate cloud environments.

On paper, they had configured traditional cloud firewalls, issued shared corporate API keys, and required single sign-on for their cloud console.
In practice, their operational reality was chaotic.

Two developers had embedded a master Anthropic API key into a staging service to debug a pipeline over the weekend. A background agent loop encountered an unhandled exception, retried a failed prompt thousands of times, and consumed thousands of USD in credits in under three hours.
Meanwhile, a compliance audit revealed that a customer-facing agent had received prompt payloads containing unredacted client financial records, which were subsequently sent to an unapproved external provider endpoint.

This story is becoming common across software teams.

Traditional perimeter security relies on static rules: IP allowlists, single API keys, and periodic access reviews.

Generative AI traffic is dynamic, non-deterministic, and frequently automated through autonomous agent loops. Static rules cannot inspect fluid prompt contexts, enforce real-time financial caps per consumer, or prevent an autonomous agent from invoking an unauthorized database action mid-stream.

To secure generative AI workflows at scale, governance must move directly into the execution path.

It must operate as a zero-trust runtime control plane that inspects, routes, redacts, and governs every single token before it leaves your network.

This is where the enterprise security layer of the Bifrost LLM + MCP Gateway comes in.

💡 Note: this article is about Enterprise LLM governance, but these concepts and tools appl also to every level of AI governance, even our home-labs.

Virtual Keys: the core identity unit for every AI request

For years, the standard approach to managing model access was simple: create an account with a provider, generate an API key, copy it into an environment file, and share it across your application cluster.

In an enterprise environment, this pattern is a major security vulnerability.

When ten microservices share a single upstream API key, you lose all operational visibility. You cannot determine which service exceeded a rate limit, which user triggered a compliance alert, or how much budget a specific customer project consumed.

💡 For curiosity: browse GitHub and look how many persona project you can find about AI governance and API keys monitoring. There have been hundreds of attempts to avoid this kind of non-traceability.

Bifrost replaces shared provider keys with a core governance abstraction: Virtual Keys (bf-virtual-key).

[ Application / Developer Agent ]
               │
               ▼  (bf-virtual-key-engineering-01)
     ┌───────────────────┐
     │  Bifrost Gateway  │ ──► Evaluates: Identity, Budgets, Rate Limits, Guardrails
     └───────────────────┘
               │
               ▼  (Provider Key safely pulled from Vault)
    [ Upstream LLM Provider ]

A Virtual Key is a scoped, per-consumer identity issued to a specific application, department, developer, or external customer integration.

Upstream provider credentials (such as your actual OpenAI, Anthropic, or Google Vertex keys) remain encrypted inside the gateway or your enterprise secret manager.

Applications never touch real provider keys. They authenticate to Bifrost using their assigned Virtual Key.

Hierarchical Budget Controls

One of the most immediate challenges in managing AI infrastructure is preventing unexpected billing spikes.

Autonomous agent loops can rapidly consume tokens if they enter infinite execution cycles.

Bifrost addresses this by implementing hierarchical budget controls directly within the Virtual Key framework. You can define financial ceilings at three distinct layers:

Virtual Key Level: Assign hard or soft spend caps to individual developers, staging microservices, or terminal agents.
Team Level: Aggregate spending across multiple Virtual Keys belonging to a specific department, such as Engineering, Marketing, or Customer Support.
Customer Level: Enforce tenant-level spend limits for multi-tenant software platforms that offer AI features to end users.

If a Virtual Key exhausts its hourly or monthly budget, Bifrost handles the event based on your policy.

You can configure the gateway to block further requests for that key, drop a notification into your monitoring pipeline, or automatically shift traffic to a lower-cost fallback model (such as a local llama.cpp instance or a self-hosted model running on vLLM).

Dual-Axis rate limits

Financial budgets prevent long-term overspending, but they do not protect against sudden, high-burst API requests that trigger provider rate limit errors.

To address this, Bifrost enforces rate limits across two distinct axes for every Virtual Key:

Requests Per Minute (RPM): Controls the overall volume of calls to prevent API spamming.
Tokens Per Minute (TPM): Regulates token volume to prevent large context windows from saturating upstream provider throughput quotas.

When you enforce these limits at the gateway layer, you can prevent a single runaway process from degrading performance for the rest of your organization.

Identity Sync, Fine-Grained RBAC, and Vault Secrets

Managing hundreds of Virtual Keys manually as an organization scales quickly becomes impractical. Enterprise security teams require central identity management and automated provisioning.

Bifrost connects directly with existing enterprise identity systems, linking corporate user directories to AI model access.
Here below a simplified diagram for the process:

┌───────────────────────────┐
│  Okta / Microsoft Entra   │ (OIDC / SSO Sync)
└─────────────┬─────────────┘
              │
              ▼
┌───────────────────────────┐
│      Bifrost Gateway      │
│  - Identity Mapping       │
│  - Custom RBAC Roles      │
│  - Vault Secrets Fetch    │
└─────────────┬─────────────┘
              │
              ├──────► [ HashiCorp Vault ]
              ├──────► [ AWS Secrets Manager ]
              ├──────► [ Azure Key Vault ]
              └──────► [ Google Secret Manager ]

SSO and OIDC Identity Providers

Bifrost supports OpenID Connect (OIDC) and Single Sign-On (SSO) integration with major enterprise identity providers, including Okta and Microsoft Entra ID (formerly Azure AD).

When an engineer launches a terminal coding agent or logs into a desktop client through Bifrost Edge, their corporate identity is verified against your primary directory. User group memberships are automatically synchronized, assigning appropriate access policies without manual administrative intervention.

Fine-Grained Role-Based Access Control (RBAC) and Data Access Control

Authentication identifies who the consumer is; authorization determines what they are permitted to do.
Bifrost provides fine-grained Role-Based Access Control (RBAC) coupled with Data Access Control (DAC) through configurable Access Profiles.

Instead of granting global access to all connected models and data pipelines, administrators define granular permission policies:

Model Access Restrictions: A junior developer profile can be restricted to fast, lightweight models for daily tasks, while senior staff or automated release pipelines are authorized to invoke frontier models.

Feature Restrictions: Certain roles can be permitted to run standard text completions while being blocked from executing raw code interpreters or file system tools.
Data Access Control (DAC): Access Profiles restrict which internal knowledge bases, database indexes, or document stores a specific user group can query through the gateway.

Zero-Plaintext Secret Management via External Vaults

Storing raw provider keys in plain text inside environment variables or static configuration files is a major compliance risk for regulated industries.
Bifrost integrates natively with leading enterprise secret managers:

HashiCorp Vault
AWS Secrets Manager
Google Secret Manager
Azure Key Vault

When Bifrost routes a request to an upstream provider, it fetches the necessary credentials dynamically from your secure vault at runtime. API keys are decrypted in memory, used to execute the request, and never written to disk or exposed in user-facing configuration dashboards.

In-Flight Guardrails and Policy-Driven Routing

Securing the perimeter and managing identities is only half the battle.
Because generative AI outputs are variable, security policies must also inspect payload contents as traffic flows through the gateway.

Bifrost implements In-Flight Guardrails that act as real-time filters on both incoming prompts and outgoing model responses.

Real-Time Validation and Redaction

Guardrails in Bifrost operate directly in the request-response path, introducing negligible latency while executing multi-stage safety checks:

PII and Sensitive Data Redaction: Integrating with detection engines like Microsoft Presidio and Azure AI, Bifrost identifies sensitive data - such as Social Security numbers, credit card details, medical record identifiers, and custom internal project code names - and redacts or hashes them before the prompt leaves the internal network.

Secrets Detection: The gateway scans outgoing payloads for leaked credentials, private RSA keys, AWS access tokens, or internal database connection strings, blocking requests that contain exposed secrets.
Schema Enforcement: For structured agent workflows, Bifrost validates JSON responses against predefined schemas. If a model generates malformed outputs or unexpected fields, the gateway can request a correction or drop the payload before it reaches downstream production systems.
Custom Policy Rules: Organizations can define custom Common Expression Language (CEL) assertions to enforce business-specific safety compliance, such as blocking prompts containing competitive benchmarking requests or unvetted external URLs.

Policy-Driven Routing and Approved Model Enforcement

In regulated environments, allowing applications to route requests to arbitrary external model endpoints creates significant legal exposure.

Bifrost enables administrators to write strict routing policies that dictate exactly which models can process specific classes of data:

{
  "policy_name": "enforce-compliant-routing",
  "rules": [
    {
      "condition": "context.data_classification == 'PII_SENSITIVE'",
      "allowed_providers": ["in-vpc-vllm-cluster", "azure-hipaa-instance"],
      "action": "PERMIT"
    },
    {
      "condition": "context.data_classification == 'PUBLIC'",
      "allowed_providers": ["openai-gpt4o", "anthropic-claude"],
      "action": "PERMIT"
    }
  ]
}

If an application attempts to send sensitive internal data to an unapproved public endpoint, Bifrost intercepts the request, blocks the call, and logs a compliance violation event.

If an approved primary endpoint becomes unavailable or hits a rate limit, the policy router automatically redirects the request to a designated compliant fallback provider.

MCP Tool Scoping and Endpoint Extension

Model Context Protocol (MCP) allows language models to interface with external tools, databases, and APIs. Many Agent Harness use them: they have an unified standard protocol, so you can use them in Claude Code, Codex OpenCode and all others without changing a thing.

However, giving an agent access to an MCP server without granular boundaries creates serious operational risk.
If an agent is connected to a database server, you must ensure it can execute read queries without having the authority to execute drop or truncate operations.

Bifrost enforces tool scoping at the Virtual Key level using MCP Tool Filtering.

                           ┌───────────────────────────┐
                           │      Bifrost Gateway      │
                           └─────────────┬─────────────┘
                                         │
                 ┌───────────────────────┴───────────────────────┐
                 ▼                                               ▼
  [ Virtual Key: Customer Support ]             [ Virtual Key: Systems Admin ]
  - Filtered Tools:                              - Unrestricted Tools:
    ✓ crm_lookup_customer                          ✓ crm_lookup_customer
    ✓ crm_get_order_history                        ✓ crm_update_record
    ✗ crm_delete_customer                          ✓ crm_delete_customer

When an agent requests the list of available tools, Bifrost intersects the upstream MCP server's tool catalog with the Virtual Key's allowed tool profile. Unauthorized tools are stripped from the response context entirely.

The model remains unaware that restricted tools exist, removing the possibility of accidental or malicious invocation.

Bifrost Edge: Extending Governance to the Endpoint

Centralized gateway governance is highly effective for cloud-hosted applications, but developer laptops represent a major unmanaged perimeter.

When an engineer runs an AI-assisted IDE or terminal tool locally, they might configure the tool to bypass central gateway rules.
Bifrost Edge extends these runtime governance controls directly down to the physical endpoint.

Running as a lightweight agent in the background on macOS, Windows, or Linux, Bifrost Edge automatically detects local AI traffic generated by desktop applications, browser tabs, or terminal harnesses.

It routes that traffic through your central Bifrost Gateway without requiring developers to manually edit configuration files or manage local environment keys.

Virtual Key restrictions, budget caps, PII redaction rules, and MCP tool filters are applied to local desktop activities just as strictly as they are to production cloud pipelines.

Immutable Audit Logs, Data Lakes, and Telemetry

In regulated industries governed by standards like SOC 2, GDPR, HIPAA, and ISO 27001, security policies must be verifiable through audit records.

Saying you have security policies is not enough; you must be able to prove every action taken by every model and agent across your infrastructure.

Bifrost provides a comprehensive telemetry and logging framework designed to meet enterprise compliance standards.

Cryptographically Traceable Audit Trails

Every request passing through Bifrost generates an immutable audit log entry. Each log record captures:

The originating Virtual Key, authenticated user identity, and team assignment
The target provider, exact model version, and routing path selected
Prompt token counts, completion token counts, total latency, and precise financial cost
Intercepted guardrail events, including redacted PII elements or blocked policy violations
Exact parameters and execution results for all invoked MCP tools

Content logging can be selectively masked or encrypted per environment to ensure that sensitive user inputs are never stored in plain text within log storage.

Data Lake and Storage System Exports

For long-term compliance archiving and security analysis, Bifrost streams audit records directly to enterprise data lakes and storage systems.

Built-in streaming adapters support direct exports to Amazon S3, Google Cloud Storage, BigQuery, Apache Kafka, and Google Cloud Pub/Sub. Security teams can query historical AI operations using their existing SIEM tools to detect anomalous usage patterns or build custom compliance reporting dashboards.

Native Observability Integrations

Operational monitoring is critical for maintaining infrastructure health. Bifrost exposes deep system telemetry out of the box:

OpenTelemetry (OTel): Full support for distributed tracing, allowing you to trace a user request as it moves through frontend applications, the Bifrost Gateway, internal vector databases, and external model endpoints.
Prometheus Metrics: Standard metrics endpoints exposing request rates, error codes, token usage velocity, and microsecond-level latency histograms.
Datadog Connector: Pre-built integration dashboards providing instant visibility into model consumption, cost distribution across Virtual Keys, and active guardrail blocks.
Maxim Observability Suite: Deep integration with Maxim's enterprise platform for advanced evaluation, regression testing, and prompt monitoring.

In-VPC Deployment and High-Availability Clustering

Enterprise security policies often prohibit sensitive data from traversing public proxy layers or multi-tenant management systems.

Bifrost is designed to run entirely within your secure corporate perimeter.

┌────────────────────────────────────────────────────────────────────────┐
│                        Virtual Private Cloud (VPC)                     │
│                                                                        │
│   ┌────────────────────────────────────────────────────────────────┐   │
│   │                    Bifrost Cluster (In-VPC)                    │   │
│   │                                                                │   │
│   │   ┌─────────────┐       ┌─────────────┐       ┌─────────────┐  │   │
│   │   │ Gateway N1  │ ◄───► │ Gateway N2  │ ◄───► │ Gateway N3  │  │   │
│   │   └─────────────┘       └─────────────┘       └─────────────┘  │   │
│   │          ▲                     ▲                     ▲         │   │
│   └──────────┼─────────────────────┼─────────────────────┼─────────┘   │
│              │                     │                     │             │
│   ┌──────────┴────────┐   ┌────────┴─────────┐   ┌───────┴─────────┐   │
│   │ Self-Hosted vLLM  │   │ Encrypted Vault  │   │ Local Audit Log │   │
│   └───────────────────┘   └──────────────────┘   └─────────────────┘   │
└────────────────────────────────────────────────────────────────────────┘

Air-Gapped and Regulated Architecture

You can deploy Bifrost directly into your private cloud (AWS VPC, Google Cloud VPC, Azure VNet) or air-gapped on-premises environments.

In this architecture, zero telemetry, configuration data, or prompt payloads leave your controlled network space.

Internal data encryption uses AES-256-GCM with keys derived via Argon2id, protecting cached parameters and key configurations at rest.

High-Throughput performance and active-active Clustering

Security controls must not create performance bottlenecks. Written in pure Go, Bifrost introduces less than 15 microseconds of execution overhead per request under typical workloads.
To support large enterprise operations, Bifrost scales horizontally in active-active cluster configurations:

State Synchronization: Distributed nodes synchronize state, active rate limits, and budget tracking in memory using lightweight synchronization protocols.
High Availability: If a cluster node fails, traffic is redistributed seamlessly without dropping active client connections or resetting rate limit counters.
Scalability: Benchmarked at over 5,000 requests per second (RPS) per node, a Bifrost cluster can handle heavy enterprise traffic loads while maintaining sub-millisecond routing decisions.

To see how runtime gateway governance differs from traditional API management, consider this side-by-side comparison:

Action Plan: implementing runtime Governance in 10 Minutes

If you want to move your organization from static API keys to runtime governance, you can test these controls locally today before rolling them out to your cloud infrastructure.

Step 1: Fire up the Local Gateway

Open your terminal and launch the gateway:

npx -y @maximhq/bifrost

The administration dashboard will open at http://localhost:8080.

Step 2: Configure a Provider via Secret Manager

In the dashboard, navigate to Model Providers. Instead of entering a raw API key in plain text, select your enterprise secret manager backend (such as HashiCorp Vault or AWS Secrets Manager) and provide the secret path string.

Step 3: Create Your First Virtual Key and Budget Policy

Navigate to Virtual Keys and select Create Virtual Key:

Name the key engineering-coding-agents.
Set a maximum monthly spend limit of $200.00.
Set a rate limit of 100 Requests Per Minute and 100,000 Tokens Per Minute.
Assign a fallback route pointing to a local or secondary model if the primary budget is exceeded.

Step 4: Enable In-Flight PII Redaction

Under the Guardrails tab, toggle on the PII Masking Profile. Select the entities you wish to redact (e.g., credit card numbers, email addresses, explicit secret keys).

Step 5: Test a Request Using the Virtual Key

Send a test request using cURL, passing your newly created Virtual Key in the header:

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer bf-virtual-key-engineering-coding-agents" \
  -d '{
    "model": "gpt-4o",
    "messages": [
      {"role": "user", "content": "Hello, my secret token is AWS_TOKEN_123456789. Please optimize this query."}
    ]
  }'

Check your Bifrost audit dashboard. You will see that the request was logged under the engineering-coding-agents key, the sensitive token was redacted in flight, the financial cost was deducted from the key's budget, and the metrics were streamed to your local telemetry pipeline.

Conclusion: The Shift to Zero-Trust AI Infrastructure

The rapid adoption of generative AI has gone beyond traditional perimeter security models. Treating model access as a simple matter of handing out API keys is no longer viable for enterprise engineering teams.

Bifrost transforms how organizations manage model infrastructure: with the simple rule of placing runtime controls directly at the gateway layer.

You gain total visibility into model operations, protect internal systems from data leakage, prevent run-away financial costs, and enforce fine-grained role-based access across every model, tool, and endpoint in your enterprise network.
Security does not have to come at the expense of developer speed.

With sub-15 microsecond latency, zero-config endpoint routing via Bifrost Edge, and native integrations with the enterprise identity and secret management tools you already rely on, Bifrost provides a clear path for enterprise AI deployment.

Have questions about setting up OIDC mapping, configuring custom guardrail policies, or deploying Bifrost clusters inside your VPC? Leave a comment below or join the discussion!

Scoping and Governing Agent Tool Access at Enterprise Scale with MCP Tool Groups

Fabio Matricardi — Tue, 14 Jul 2026 18:27:47 +0000

Moving past individual API keys to true Role-Based Access Control for your models using the Bifrost LLM + MCP Gateway.

If you’ve been following me, you already know I’m a massive advocate for local AI, developer autonomy, and optimizing your infrastructure.

In my previous article called “The AI Governance blind spot: why your Corporate accounts are not enough (and how Bifrost Edge closes the loop)”, I walked you through how Bifrost Edge acts as the ultimate local physical enforcer, catching all endpoint AI traffic from tools like OpenCode or Claude Code and routing it securely through your central Bifrost Gateway.

But once you lock down the network path at the endpoint, you immediately run into the next, much larger enterprise milestone.

Imagine a developer launches an AI coding agent on their laptop. The local Bifrost Edge agent secures the channel, matches it to their identity, and hands it to the central gateway.

But on that gateway, you have connected your company’s core database, internal CRMs, and production GitHub repositories via Model Context Protocol (MCP) servers.

Suddenly, that developer’s AI agent discovers it has unrestricted programmatic authority to read, write, or drop entire tables across your company’s internal infrastructure.

You see, the moment your AI agents move from writing simple text to orchestrating actual code and manipulating systems, enterprise AI governance shifts from a purely financial discussion about cost control to a critical battlefield for preventing data leakage, catastrophic data loss, and severe production impacts.

If a model misinterprets a prompt, hallucinates a parameter, or encounters a tool-poisoning attack, it can execute irreversible side effects. Handing out a single master API key or exposing raw, un-scoped tool directories to every worker is an open invitation to infrastructure failure.

To solve this the team at Maxim decided a bold move: Bifrost introduces an enterprise-grade layer of defense: MCP Tool Groups, bringing true, fine-grained Role-Based Access Control (RBAC) to your AI ecosystem.

TL;DR

Raw tool access is a liability: Exposing raw MCP connections means a single prompt error could allow an agent to modify files or drop production tables.
Virtual Keys need abstraction: Juggling fine-grained tool rules key-by-key for dozens of employees creates a massive administrative headache at scale.
MCP Tool Groups are the fix: They act as security groups for your AI, allowing you to bundle specific tools from multiple MCP servers into a single named policy.
Zero-Overhead Resolution: Bifrost resolves these complex permissions in-memory at the request layer, preserving its ultra-fast 11μs execution speed.
Airtight Endpoint Enforcement: By pairing Tool Groups with Bifrost Edge, endpoint agents are strictly fenced into their approved scopes with zero manual configuration.

Moving From Basic Keys to Role-Based Access Control

In the early chapters of our Bifrost setup, we solved the basic security dilemma by using Virtual Keys. You could give a specific team a dedicated key, slap a financial budget cap on it, and feel relatively safe.

But as your company grows, managing tools individual key by individual key turns into an absolute nightmare.

If you have 20 developers, 5 QA engineers, and 4 database administrators all using different terminal-based agents, writing custom tool allowlists for every single independent Virtual Key is a losing battle. If an upstream MCP server updates and introduces five new tools, you have to manually audit and update dozens of keys. It simply doesn’t scale.

This is exactly why the team at Maxim designed MCP Tool Groups.

Think of it this way: If Virtual Keys are your individual corporate user accounts, Tool Groups are your Active Directory or RBAC security groups.

Instead of linking a raw MCP client directly to a user, you create a named collection of tools.

A Tool Group can pull specific capabilities from one or multiple connected MCP servers. You define the boundary once, and then you simply assign that group to any combination of Virtual Keys, teams, or corporate departments.

When a request hits the Bifrost LLM + MCP Gateway, the engine performs a blazing-fast, in-memory evaluation. It looks at who is making the call, checks their assigned Tool Groups, merges overlapping scopes, and deduplicates the allowed functions.

The underlying model only ever receives definitions for the exact tools it is authorized to see for that specific turn. If a tool isn’t in the resolved group, its definition is completely stripped from the context. To the model, those unauthorized capabilities do not even exist.

Real-World Architectural Mapping

You shouldn’t guess what your tool permissions should look like. A mature enterprise workspace segregates tool footprints logically by team intent and environment risk.

Here is a practical blueprint of how a company structures its tool boundaries across different departments using Bifrost:

When you start segregating tools this way, you guarantee least-privilege access. A support agent using an AI copilot can easily pull up a customer’s record to help them resolve a ticket, but their agent is fundamentally incapable of running a script that alters a software branch or alters a structural database table.

Technical Deep-Dive: Configuring a Tool Group

Let’s look at how easily this is handled inside the Bifrost web interface. In this walkthrough, we will take our 41-tool GitHub Copilot MCP connection from Part 2 and scope it down into a safe, restricted development group.

Step 0: Ensure you have Bifrost running

There are 2 main ways to install Bifrost: one is with a Docker image, the second one is with npm. In this article I will show you the steps realted to Node.js® (npm): for the docker image you can follow the steps in the official documentation.

At its core, NPM (Node Package Manager) is a package manager for JavaScript, and it comes bundled with Node.js. Its primary function is to help you manage project dependencies seamlessly. With NPM, you can easily install, update, and remove packages, making it an indispensable tool for Node. js developers.

Basically all we need is node.js

Download the installer from the official page and run it.

The procedure is quite straight forward… You can verify if everything is correctly done with one single command. Open a terminal, everywhere and run:

node -v
npm -v

Install Bifrost

After you have installed node.js, open the terminal everywhere and run:

# Install and run locally
npx -y @maximhq/bifrost

The first time the command will download the binaries and run the Bifrost Gataway on localhost:8080.

In fact, you can open your browser at http://localhost:8080 and the Bifrost dashboard will be up

Step 1: Navigate to Tool Groups

Open your Bifrost Dashboard (typically running at http://localhost:8080 or your internal server address).

In the left sidebar, head over to the MCP management zone and click on the Tool Groups tab. Click Create Tool Group.

Step 2: Define the Policy Name and Spec
Give your group a clear, descriptive name, such as junior-dev-git-policy.

{
  "name": "junior-dev-git-policy",
  "description": "Restricted GitHub actions for junior engineering profiles",
  "resources": [
    "github/github-mcp-server"
  ],
  "allowlist": [
    "search_repositories",
    "get_issue",
    "create_issue_comment"
  ]
}

Notice what we are doing here: out of the 41 powerful tools exposed by the raw GitHub server, we are explicitly allowlisting only three read-oriented or low-risk actions. Powerful capabilities like deleting repositories or force-pushing to production branches are left completely off the list.

Step 3: Bind the Group to a Virtual Key
Save the group policy. Now, navigate to your Virtual Keys screen. Select the keys assigned to your junior engineering pool or contract developers. Under their MCP Settings block, simply toggle on the junior-dev-git-policy checkbox.

Step 4: Verify the Fenced Audit Logs
When the junior developer launches their agent (like OpenCode or Claude Code), Bifrost resolves the payload.

If the developer tries to prompt the agent to do something out of bounds (like deleting an upstream repository branch) the central gateway catches the missing tool execution token and drops a clean, safe violation message into your audit stream.

[2026-07-12 14:15:22] [WARN] [VK-JUNIOR-DEV-04] Tool execution blocked: 
User attempted to invoke 'delete_branch' on server 'github-mcp-server'. 
Reason: Operation not permitted by 'junior-dev-git-policy'. Status: 403 Forbidden.

Conclusions: The Complete Enterprise Perimeter

We are officially past the era of treating AI agents like isolated sandboxes. When your terminal tools, desktop assistants, and cloud-hosted models are given the power to touch real data networks, they require the exact same deterministic boundaries you apply to human employees.

Relying on raw API limits or basic budget caps won’t save you from a junior developer’s agent accidentally running a destructive script or leaking sensitive code.

True enterprise governance requires a two-part shield:

At the Endpoint (Bifrost Edge): Enforcing company-wide routing straight from the developer’s laptop so that corporate data never bleeds out into consumer-grade, unmanaged personal accounts.
At the Gateway (MCP Tool Groups): Structuring airtight, role-based boundaries so that even inside the secure corporate perimeter, an agent can only ever see and execute the specific tools it needs to fulfill its immediate role.

When you can combine the centralized brain of the Bifrost LLM + MCP Gateway with the machine-level enforcement of Bifrost Edge, enterprises finally gain complete data sovereignty.

You get a bulletproof layer that dramatically lowers token overhead through Code Mode, stops data leakage dead in its tracks, prevents catastrophic data loss, and protects your production environments from erratic agent loops: all recorded in a single, immutable compliance audit log.

Your Turn: Secure Your Workspace Infrastructure

If you want to move your team past wild-west tool access and achieve real peace of mind, take these concrete steps this week:

1️⃣ Map Your High-Risk Primitives: Review your connected MCP servers and flag any tool that possesses system write access, file deletion, or sensitive database access.

2️⃣ Build Your First Enterprise Group: Open the Bifrost UI and group those high-risk tools into a dedicated administrative policy block, separating them completely from basic read-only utilities.

3️⃣ Audit an Agent Turn: Run a live terminal session via bifrost-cli, try to issue a command that calls an unmapped or restricted tool, and watch how cleanly the gateway blocks the action in your system logs.

AI independence shouldn’t mean sacrificing infrastructure control.

When you set clear boundaries at the gateway and enforce them cleanly down to the user endpoint with Edge, you give your team the ultimate workspace to build with safety and with total compliance.

How are you organizing permissions for your team’s external tools? Drop a comment below and let me know how your security configuration shapes up!

The AI Governance blind spot: why your Corporate accounts are not enough (and how Bifrost Edge closes the loop)

Fabio Matricardi — Thu, 18 Jun 2026 18:11:28 +0000

Even with paid Anthropic team tiers and company-wide Google AI Pro accounts, data leaks still happen the moment token limits hit. Here is how pairing Bifrost Gateway with Bifrost Edge secures any team from the endpoint up.

Even AI expert can miss it all.

A few weeks ago, I was looking at an internal audit report tracking AI usage across our 20-person team, and I swear I felt cold sweat run down my spine.

On paper, we had done everything right. We are not a giant enterprise with a massive IT department, but we care about tools: we pay for Anthropic team tiers, and every single employee has an official corporate Google AI Pro account. We thought we were fully covered. We thought providing official, paid access meant our company documents and client data were completely safe.
But when I looked at the actual traffic logs on our local network? I had to reconsider myself.

Our team was hitting their official daily token limits, and not only during high-pressure deadlines. And what happens when a hard-working engineer runs out of corporate tokens at 4:00 PM with a pile of work left? They don't stop working. They simply open a personal browser tab, log into a free, personal AI account, and keep going.

That's when the brutal reality hit me: proprietary code, unreleased client data, and sensitive NDA details were slipping out through personal accounts anyway.
This is the AI governance blind spot no one talks about, especially in Enterprises: fast-moving companies facing challenges on daily basis. You can buy the best corporate accounts on earth, but the moment your team faces a token limit, they will fall back to personal tools.

Fortunately, we don't have to stay vulnerable.

A massive launch from the engineering team at Bifrost has changed how we handle security by doing something at the same time simple and smart: expanding central control all the way down to the user's physical desktop using Bifrost Edge.
Let's go.

The silent rise of "Bring Your Own AI" (BYOAI)

Let's look at the numbers first, because the data paints a genuinely alarming picture of corporate vulnerability.
According to massive workplace studies conducted recently, artificial intelligence is no longer a fringe experiment.

A prominent Work Trend Index report published by Microsoft and LinkedIn revealed that a staggering 75% of global knowledge workers use generative AI at work.

datawrapper.dwcdn.net

The statistic should make every manager and business owner pause:

According to Microsoft and LinkedIn's 2024 Work Trend Index Annual Report (survey of 31,000 workers across 31 countries), 78% of AI users bring their own personal AI tools to work. BYOAI spans generations: 85% of Gen Z, 78% of Millennials, 76% of Gen X, and 73% of Boomers. aiin

Consider that this is not a trend recorded among twenty-something software developers. The data shows that 73% of professionals in their 40s and 50s are actively bringing unsanctioned AI tools into their daily workflows.

Why is this happening?

I personally believe that this is not malicious. In a tight team of 20 people, everyone is multitasking and trying to keep up with intense workloads. If a professional is swamped with a 50-page vendor contract or a messy spreadsheet, and their official corporate account tells them they have hit their hourly or daily token limit, the logical step for them is to open a personal tab, paste the text, and ask for a quick summary.

[Personal Chatbot Tab] ──> Data Harvested for Public Training">[Employee Laptop] ──(Corporate Tokens Exhausted)──> [Personal Chatbot Tab] ──> Data Harvested for Public Training

The underlying issue is a massive AI oversight gap.

Industry reports show that 63% of organizations have no formal AI governance policy or are still vaguely developing one.
Employees simply do not receive formal training on what constitutes an NDA violation when interacting with an LLM (Large Language Model).
They don't realize that pasting a client's proprietary financial data or an internal software script into a standard consumer-tier AI tool means that data is frequently ingested, stored on external servers, and potentially used to retrain future public models.

Shadow AI is a severe corporate threat vector: that 20% of surveyed organizations suffered a material breach.

When "Shadow AI" bites: the reality of Data Leaks

When employees use software, hardware, or AI applications outside the direct supervision of the company, it is known as Shadow AI.
In 2026, Shadow AI has officially graduated into one of the fastest-growing risks for businesses of all sizes.
The consequences are no longer theoretical. The IBM Cost of a Data Breach Report formally highlighted Shadow AI as a severe corporate threat vector, revealing that 20% of surveyed organizations suffered a material breach specifically due to unsanctioned AI tools.
Even worse, the report highlighted that breaches involving Shadow AI added an average premium of $670,000 to the already painful price tag of a data breach, routinely compromising highly sensitive Personally Identifiable Information (PII) and core Intellectual Property (IP).

IBM's 2025 Cost of a Data Breach Report (with the Ponemon Institute) found that 20% of organizations suffered a breach specifically due to shadow AI (unsanctioned AI tools), and these incidents added an average of $670,000 to breach costs, disproportionately exposing customer PII and intellectual property. nudgesecurity

Consider what can go wrong when an unmanaged workspace runs out of corporate tokens:

Codebase Hijack

A well-meaning developer feeds an unreleased software module into a free, personal web-based coding assistant to debug a memory leak after hitting their corporate limit. Months later, portions of that proprietary logic surface as code suggestions for external developers worldwide because the free tool routinely harvested inputs for public model training.

Corporate Memory Leak

High-profile vulnerabilities discovered by security researchers have shown that advanced "prompt injection" attacks can trick consumer AI applications into completely exfiltrating historical conversation logs, exposing sensitive corporate strategy decks, legal memos, and payroll data hidden deep within past chat threads.

How a Small Company or Enterprise can finally gain AI Governance?

Bifrost is suggesting us two key steps to start controlling AI App Access: Bifrost gateway as the Control Room that centralizes governance, and Bifrost Edge to enforces these Company values and Governance on every machine.

Part 1: the Centralized Brain. Bifrost Gateway

To stop this data bleeding and keep track of our team’s usage, we need a unified command center. This is exactly what Bifrost Gateway does.

Bifrost CLI is the AI gateway for coding agents we were waiting for

Developed in pure Go by the optimization experts at Maxim, Bifrost Gateway acts as a highly resilient, enterprise-grade “traffic cop” that sits squarely between your applications and world-class AI providers like OpenAI, Anthropic, Google Gemini, or even your own self-hosted local AI engines, like Ollama or llama.cpp server.

Instead of hardcoding high-risk API keys directly into individual applications (where they can easily be stolen or abused) every single application talks exclusively to Bifrost.

The engineering achievement here is monumental: Bifrost introduces a mere 11 microseconds of overhead under heavy loads, making it roughly 50x faster than traditional setups like LiteLLM. It provides teams with three critical pillars of protection:

Virtual Keys & Scoped Access

You can issue specific, restricted virtual credentials to different roles. Marketing gets a key capped at basic text tools, while Engineering gets access to advanced coding pipelines.

Seamless Fallbacks & Rate Management

If your primary corporate Anthropic account hits its maximum daily limit, Bifrost automatically shifts traffic to a backup model (like Google Vertex or a local model) completely transparently, ensuring your team never runs out of tokens or drops their productivity.

Multi-Tier Budget Caps

It allows you to enforce hard financial ceilings per user or per model provider, ensuring you never receive an unexpected billing surprise at the end of the month.

When you configure Bifrost (with a clean looking web-interface, running on your computer), you can define a primary provider and multiple fallback options. If your primary provider goes down, hits its rate limit, or runs out of credits, Bifrost automatically routes the request to the next provider in line.

here the limits I set on the free-tier Providers configured on my Laptop

Here’s how it works in practice:

Your app sends a request to Bifrost’s endpoint
Bifrost checks its routing rules and tries the primary provider
If the primary fails, Bifrost moves to the first fallback
If that fails too, it tries the second fallback, and so on

from the dashboard you can monitor all the details

The beauty of this system is that your application doesn’t know or care which provider ultimately handles the request. From your app’s perspective, it’s just getting responses from Bifrost. The details of which provider served the request are completely transparent to your code.

How to Install Bifrost Gateway

Setting up the core gateway engine on a standard office server or local machine is remarkably simple and takes under two minutes using Node.js (npm):

# Download and launch the Bifrost Gateway locally  
npx -y @maximhq/bifrost

Once executed, the engine fires up smoothly in the background, serving a highly intuitive web interface at http://localhost:8080. From this dashboard, you can easily navigate to the "Model Providers" section, safely input your official team API credentials, and organize a clear "Model Catalog."

One of the biggest headaches when working with LLMs is managing costs. It’s easy to rack up hundreds of dollars in charges without realizing it, especially when you’re experimenting or running multiple projects simultaneously.

This is where Bifrost’s budget and rate limit controls come in handy.

With Bifrost, you can set budgets at multiple levels:

Per provider: Limit how much you spend on each provider
Per key: Control spending for specific API keys
Per virtual key: Set budgets for different teams or projects

For example, you might configure Bifrost like this:

Primary provider: OpenAI (high quality, higher cost)
Fallback 1: Anthropic (good quality, moderate cost)
Fallback 2: Self-hosted llama.cpp (lower quality, much cheaper)

You can then set rate limits so that if OpenAI hits its TPM (tokens per minute) limit, requests automatically shift to Anthropic. If you exceed your budget for Anthropic, traffic falls back to your self-hosted instance. This way, you get the best quality while keeping costs under control.

Part 2: enforcing Safety at the source with Bifrost Edge

While the Gateway serves as the ultimate command center, it still suffers from one fundamental flaw if deployed in isolation: it relies entirely on voluntary cooperation.

If an employee hits their limit and chooses to open a personal browser tab to use a personal account, a centralized gateway sitting in your cloud has no mechanism to see or stop that localized traffic. The company’s data perimeter remains completely compromised.

This is why the launch of Bifrost Edge is radically new.

Bifrost Edge is a lightweight, non-intrusive local agent designed to run on every physical computer across your Enterprise, departments and teams. It does not replace the Bifrost Gateway; instead, it acts as its local physical enforcer.

The concept is brilliant and elegant: after a simple, one-click browser authentication process, Bifrost Edge runs quietly as a menu-bar application. It immediately intercepts all local AI requests made on that machine (whether they originate from desktop chat applications, terminal-based developer environments, or web browsers) and automatically re-routes them through the secure channels of your corporate Bifrost Gateway.

Bifrost Edge is designed to be invisible: yet at the same time fully transparent to audits and control. After a one-time sign-in, users keep using the AI tools they already have — Claude Desktop, ChatGPT, Cursor, coding agents in the terminal — and Edge routes that traffic through your Bifrost in the background. There is no proxy to configure, no base URL to change, and nothing to remember.

Edge lives in the menu bar (macOS) or system tray (Windows and Linux). Most people set it once and never think about it again.

The first time Edge runs, the user signs in through their browser using your organization’s existing single sign-on. That sign-in links the machine to the user and syncs all policies assigned to them. No API keys are copied or pasted, and nothing sensitive lives in the app itself.

Once signed in, Edge lives in the menu bar (macOS) or system tray (Windows and Linux). From there a user can see whether they are connected, which key is active, and turn routing on or off. Most people set it once and never think about it again.

Bifrost Edge provides out-of-the-box routing, governance, and policy enforcement across a diverse range of AI-driven tools and platforms. Its coverage spans native desktop applications like Claude Desktop, ChatGPT, Cursor, and Codex, as well as coding agents such as Claude Code, Codex CLI, and OpenCode.

Additionally, it monitors browser-based AI surfaces (chatgpt.com and claude.ai) and handles MCP (Model Context Protocol) server discovery for deep ecosystem integration.

This traffic management is backed by extensive support for major foundational AI providers, including OpenAI, Anthropic, Azure, AWS Bedrock, Google Gemini, and many others, ensuring that all outgoing requests align with organization-wide compliance and security rules.

The benefits of the Bifrost Edge integration

Because you are tying the local machine endpoint directly to your central gateway, you can now have a unified setup that completely neutralizes the token-exhaustion trap:

Zero-Configuration Endpoint Routing

Employees no longer have to manually paste base URLs, edit sensitive .json system files, or juggle complex environment variables to ensure their productivity tools (like Cursor, Claude Code, or Opencode) are compliant. Bifrost Edge intercepts the communication at the system level and routes it automatically.

Automatic Fallbacks Instead of Personal Accounts

When a team member exhausts their primary corporate token allowance, Bifrost Edge and the Gateway handle it gracefully behind the scenes. Instead of forcing the employee to switch to a vulnerable personal account, Bifrost seamlessly swaps them to a secondary corporate fallback model. The user keeps working without interruptions, and the data stays safe.

Total Visibility & Audit Logging

Every single local AI interaction is securely logged. You can instantly audit precisely which employee tools are being called, track latency, monitor context lengths, and review the structural arguments being processed, maintaining an unshakeable audit trail for compliance purposes.

How to Install Bifrost Edge across the Team

Bifrost Edge is built for fleet-wide deployment via existing device management platforms (MDMs) across macOS, Windows, and Linux. Instead of requiring users to manually download or configure software, administrators can push Edge to all target machines simultaneously using systems like Jamf, Microsoft Intune, Kandji, Workspace ONE, or JumpCloud.

The installation process includes a centrally managed configuration profile that pre-points every device to the organization’s specific Bifrost gateway, meaning users never have to manually input server addresses or security keys.

The first time the application runs on a machine, it initiates a quick onboarding sequence requiring minimal user interaction.

The user is prompted for a single setup approval to authorize device-level AI traffic routing, followed by a one-time single sign-on (SSO) browser login to tie the machine to their corporate identity.

Once initialized, the software operates in the background, automatically pulling down and syncing centralized governance changes : application policies, routing rules, and MCP server allow/deny lists

All of those without requiring further administrative touchpoints on individual machines.

Unified AI Governance in practice: a real-World comparison

To understand how completely this duo shifts the landscape for Companies and Enterprises (regardless of the size), let’s look at a practical comparison:

https://datawrapper.dwcdn.net/13XYb/1/

⚠️ **Critical Security Note:** Relying solely on employee 
compliance to protect company secrets is an outdated security 
posture. In a modern work environment, effective security is 
never about restricting user productivity — it is about providing 
an automated infrastructure that protects users from making 
accidental data-sharing mistakes when they are stressed or facing 
tight deadlines.

The Infrastructure shift of 2026

The true future of AI for Enterprises and small/medium businesses does not rely on waiting for the next public language model to drop. It is entirely about building smart and safe infrastructure around the official models you are already paying for today… Or the llama.cpp and Ollama models you are hosting yourself

For years, Companies have been playing an exhausting game of security whack-a-mole. We buy our team paid accounts, hope for the best, and cross our fingers that no one leaks client data during a late-night rush.

But heavy-handed restrictions only drive employees deeper into the shadows, encouraging them to find creative ways to use unauthorized personal accounts to get their jobs done.

Bifrost can break this vicious cycle with elegance.

When you pair Bifrost Gateway with Bifrost Edge, you are no longer forcing your staff to choose between being highly productive or being strictly compliant.

The Gateway gives your company a powerful, centralized brain to control costs, route traffic, and handle fallback options when corporate token limits are pushed to the brink.

The Edge gives that brain the physical presence it needs on every laptop, ensuring that all AI traffic stays safely within your secure corporate perimeter.

This is what mature AI governance looks like for teams that need to stay agile. It is completely transparent, incredibly fast, and practically zero-config for the end user.

Your turn: an action plan for your team

If you are a business owner or team lead trying to wrap your head around your actual AI exposure, take these three simple steps this week:

Audit the Blind spots: talk to your team casually. Ask them what they do when their official daily token limits hit during a busy afternoon. You will likely be fascinated by their resourcefulness — and terrified by the security implications.
Test the Gateway: fire up the open-source version of Bifrost Gateway on a local computer (npx -y @maximhq/bifrost) to see how intuitive it is to organize providers and set up centralized fallback rules.
Secure the Laptops: deploy the Bifrost Edge agent to a few pilot devices using the Bifrost CLI, linking their daily browser and coding workflows into a single, safely guarded portal.

Don’t wait for an accidental data leak or an unmanageable billing surprise to reveal where your perimeter is cracked. Fix your infrastructure today, give your workforce the corporate fallbacks they need to thrive safely, and finally gain complete peace of mind over your team’s AI future.

Leave a comment below sharing your experiences: How is your team currently handling the challenge of daily token limits, and what guardrails have you found most effective to prevent personal account leaks?

I hope you enjoyed the post. If this story provided value and you wish to show a little support, you could:

Follow me
Highlight the parts more relevant to be remembered (it will be easier for you to find them later and for me to write better articles)
Write with me on my Medium Publication: there is no better way to learn than writing about it!
Comment here below