The primary threat of corporate GenAI adoption lies not in model hallucinations, but in granting agents excessive system privileges. If an assistant relies on a shared service account with superadmin permissions, any bug or prompt injection jeopardizes sensitive data. AGIMA developer Nazar Bashinsky outlined an infrastructure framework for an on-premise platform where security is enforced through hard code rather than instructions in a system prompt.
Core Tenet: Code Governs Logic, the LLM Handles Semantics
The platform's key engineering trade-off is built on minimizing non-deterministic behavior. Branching, API calls, loops, field validation, and database writes are executed using classic code. The language model is exclusively tasked with natural language interpretation and assembling aggregated context.
To prevent direct agent access to target systems (1C, Jira, ERP), the infrastructure is split into independent layers:
| Infrastructure Layer | Purpose | Implementation Details |
|---|---|---|
| Communication Interface | Request ingestion and author ID logging | Mattermost chatbot powered by Codex App Server |
| LLM Gateway | Model routing, rate limits, and DLP | Cost management, data masking, auditing |
| MCP Gateway | Tool and enterprise API gateway | Employee impersonation, secrets manager integration |
| Context Database | Centralized knowledge source | Consolidated database populated by background workers |
| Skill Package | Versioned business scenarios | Strictly defined action boundaries and rollback criteria |
| Audit and Tracing | End-to-end action chain logging | Immutable log of all steps and enforced policies |
Impersonation Over Service Accounts: The Two-Gateway Concept
The architecture separates two gateway types that fulfill fundamentally different roles:
- LLM Gateway: filters outbound prompts through a DLP circuit, manages queues, and reroutes calls to specific models without requiring changes to client-side code.
- MCP Gateway: manages requests to corporate services, acting as a proxy between the model and the actual API.
A critical component of the platform is the integration between the MCP Gateway and HashiCorp Vault via Single Sign-On (SSO). The model is physically isolated from credentials. When a user submits a task in Mattermost, the execution chain isolates authentication data:
- The Codex App Server records the authenticated employee's ID and forwards it to the MCP Gateway.
- The gateway queries Vault, retrieves the user's specific access token for the requested system (such as an issue tracker or financial environment), and executes the call strictly under their permissions.
- If the employee lacks permission to view balances or private tickets, the agent receives a standard infrastructure denial.
- Only the sanitized execution result is returned to the language model's context window—stripped of service headers and tokens.
Regardless of what the user requests from the model, or what command the agent attempts to simulate, the system cannot physically provide data exceeding the permissions tied to the request author's corporate profile.
Anatomy of an Enterprise Skill
Instead of haphazard text prompts, the platform employs a concept of versioned "skills." Each scenario is designed as an engineering artifact with a strict specification:
| Specification Field | Area of Responsibility |
|---|---|
| Owner | Scenario owner responsible for quality and lifecycle |
| Process step | Specific workflow step optimized by the agent |
| Sources | Authorized data sources and provenance validation rules |
| Permissions | Role model and authorization context |
| Safety rules | Specific security constraints and masking patterns |
| Eval & Audit | Error evaluation metrics and audit logging rules |
| Rollback | Deactivation or rollback mechanism in case of failure |
24/7 Background Process Orchestrator
In addition to the conversational chatbot for employees, the environment includes an autonomous pipeline orchestrator. This is a suite of services operating 24/7. They extract raw data from disparate corporate sources, normalize it into a unified schema, and populate a shared context database that agents query via optimized SQL requests.
Depending on task complexity, background agents leverage two types of model integration:
- OpenAI Agents SDK: used for complex pipelines requiring multi-step reasoning, intermediate analysis, and sequential tool invocation;
- Direct API call: a deterministic single request with a fixed prompt for trivial classification or string normalization tasks.
Boundaries of the On-Premise Environment
The infrastructure gateway completely eliminates service token leakage and protects private APIs from unconstrained agent modifications. However, developers emphasize that LLM perimeter defenses cannot prevent manual data copying by humans.
To establish a comprehensive security posture, an on-premise agent environment must be supplemented with administrative controls: centralized mobile device management (MDM), corporate gateway blocking of public cloud AI services, and monitoring of anomalous employee behavior.