Ingress
Shared ingress for internal AI applications with SSO, authorization, logging, and rate limits.
Ingress is how a request reaches an internal application, and where authentication, authorization, and logging are applied. A prototype can bypass established ingress when a public URL is the fastest way to share it.
Ingress sprawl
A builder who needs to share a prototype may choose a laptop tunnel when the platform's ingress process takes days. If the prototype becomes useful, that temporary route can remain in production without standard authentication or a clear owner.
The platform path must be fast enough to compete with that workaround. A slow ingress request encourages builders to keep the temporary route regardless of policy. See idea to production.
A shared ingress layer
Route internal AI applications through a shared ingress layer so each team does not have to implement the same controls:
- Apply SSO without requiring each application to implement a login.
- Enforce group-based access before a request reaches the application.
- Record who reached each application, when, and from where.
- Use rate limits for abuse protection and spend control.
- Manage TLS certificates centrally.
- Provide a central way to disable a misbehaving application without finding its owner.
Review public exposure
Use self-service for internal ingress and require review before public exposure. An externally reachable AI application accepts untrusted input and incurs costs from outside traffic. Its output is also a public statement by the organization. An accountable owner should approve the exposure after reviewing rate limits, abuse handling, and the systems the application can reach.
Separate the internal and public processes because their review and response requirements differ.
The chatbot invented a refund policy and the airline had to honour it
Air Canada's website chatbot told Jake Moffatt he could apply for a bereavement fare retroactively. The airline's actual policy said the opposite. British Columbia's Civil Resolution Tribunal held the airline liable for negligent misrepresentation.
The skipped letter. Control. Nothing constrained what the model could assert about company policy, and no versioned, reviewed source of policy text sat between the model and the customer. A retrieval boundary is a control, not a feature.
Moffatt v. Air Canada, 2024 BCCRT 149 (decision text) / American Bar Association: BC tribunal confirms companies remain liable
Partner and contractor access
The requirement that breaks naive designs is external collaborators who need access to some internal applications and nothing else.
Federate partner identity at the ingress layer. The partner authenticates against their own identity provider. Ingress maps the identity to a scoped role, and the grant expires with the engagement. This avoids broad VPN access and forgotten guest accounts. Shared credentials sent by email remove individual attribution and complicate offboarding.
Questions to ask your vendor, or your own team
- How many internal AI applications are reachable right now, and through what?
- How long does it take to get a hostname with SSO in front of it?
- Is there a tunnel running from someone's laptop that people depend on?
- Can you cut off one application in under five minutes without finding its owner?
- What is the process for making an AI application public, and who signs it?
- How do external collaborators reach the applications they need?