Frameworks for Enterprise AI

Long-form decision guides for security teams, platform engineers and architects evaluating how to deploy LLMs, MCP servers and AI agents in regulated environments.

Each guide is a decision framework, not a feature pitch.

Zero Trust16 min read

Zero Trust, Verified

How the Ferentin platform maps to the three-tier Zero Trust framework for autonomous AI agents — control family by control family, plane by plane, with the gaps named as plainly as the strengths.

A flat-lay of the four travel documents an enterprise AI agent carries: a Republic of Ferentin passport, a boarding pass, a Schengen-style visa and a luggage tag.

Agent identity22 min read

Itinerary-Based Access

Why securing agents needs to move beyond the Passport. International travel takes four documents, not one. So does enterprise AI. Inside the passport, the visa, the boarding pass and the luggage tag. And the gates that read them.

Seven control families for agentic AI with authority anchored in customer-held systems

Agentic AI governance25 min read

The CISO Reference for Agentic AI

Seven control families (identity, surface, action, network, execution, observability and containment) expanded into implementation criteria, common traps and the seams where real deployments fail. Authority anchored in customer-held systems.

Three MCP architectures compared: direct, self-hosted gateway and trust layer, with the three kill points of identity, operations and coverage.

MCP architecture16 min read

MCP Server Access: Direct vs Gateway-Brokered

Updated for MCP 2026-07-28. The seven risks of connecting agents directly to MCP servers, what a self-hosted gateway costs once you count the CVEs and a flowchart that gets most teams to the right answer.

The Ferentin Service Edge inside the customer VPC carries LLM and MCP traffic from AI agents to private models, internal MCP servers and public providers. Only metadata goes to Ferentin Cloud, which also routes A2A traffic to partner agents.

Data sovereignty26 min read

Edge vs Cloud AI Gateway

Updated for MCP and A2A. Same trust layer, two deployment topologies. Cloud-managed vs customer-private edge for model calls, tool calls and agent-to-agent traffic: data path, egress shape, private upstreams, failure mode and the regulatory regimes that force the choice.