Can we call the model directly from the agent?

You can. You will not be able to prove who spent the tokens or which policy applied. We will not sign that as production.

Is this only a MuleSoft answer?

No. The plane is the requirement. Flex Gateway and Agent Fabric are how we usually build it in a Salesforce estate. An API gateway you already run can hold the same controls if it can do identity exchange and audit.

How do you handle MCP tools?

As a catalogue with entitlements per caller, served through the gateway. We will build that pattern in your org: a tool gets a version, an owner, and a scope before an agent may call it.

Does the gateway slow every call?

It adds a hop. It also removes the incident where nobody can say which agent wrote a record. We measure the latency and tell you the trade honestly.

Architecture

Every tool call and model call goes through one door.

The first week is in the org, reading what already exists. Identity on the hop, policy at the edge, and a trail that survives an audit. If an agent can reach a model or a tool without passing this plane, you do not have a control plane. The honest no: if the work is a software factory with a named delivery date, we are the wrong partner.

Send the brief

What it is

Four controls, one hop.

The control plane is the only path from a runtime to a model, a tool, or another agent. In the orgs we work in that is Flex Gateway at the edge and Agent Fabric as the plane above it.

01On-behalf-of identityThe agent acts as the named user, with a narrower token at each hop. Not a shared service account with the permissions of everyone.

02Fine-grained authorizationRelationship-based access control so tenant, team, and record boundaries are data the agent cannot argue with. OpenFGA-style models belong here.

03Rate and budgetToken buckets per caller, per business group. A runaway loop becomes a throttle, not an invoice.

04Audit and semantic policyDenied topics, field-level redaction, and prompt-side checks at the edge rather than buried in application code.

Why it matters

Without it you cannot answer the only question that matters.

Your auditor, your CFO, and your incident review all ask the same thing: who wrote that record, under whose authority, and what did it cost? Four things have to be true before you can answer.

Model routing

One door in front of several models.

Routing is a control decision, not a feature of whichever SDK the last engineer liked. The gateway is where the choice, the budget, and the audit live together.

01
High-stakes reasoning
Legal, financial, and architectural judgement goes to a frontier model. We will name which, and why, in writing.
02
High-volume extraction
Classification and intermediate transforms go to a fast model. Paying frontier prices for a field lift is a design error.
03
Sovereign workloads
Open models such as Gemma or CodeGemma inside your own cluster when code or records cannot leave the perimeter.
04
Numbers, not prose
Forecasting belongs to time-series models such as Google TimesFM. A language model guessing at a trend is not a forecast.

Model routing behind the gateway. Frontier reasoning for high-stakes work, a fast model for high-volume extraction, a local open model where data cannot leave the perimeter, and a dedicated forecasting model for numbers.

Mermaid source

flowchart TD
  A["Agents and applications"] --> G["Gateway: identity, policy, budget, audit"]
  G --> F["Frontier reasoning: Claude, OpenAI, Gemini Pro"]
  G --> H["High-volume extraction: fast, low-latency models"]
  G --> L["Local and open models in your own perimeter"]
  G --> T["Time-series forecasting models"]

In an org

A bank or an insurer.

Regulated, multi-tenant, and audited. The control plane is the reason the programme is allowed to exist.

01The agent is the officerA case agent acts on behalf of the named officer and can only see what that officer could see. The graph of entitlements says no before the model does.

02Tools behind one doorPolicy documents, core banking reads, and the knowledge base are tools in a catalogue, entitled per caller, served through the gateway.

03Evidence, not assuranceEach hop leaves which identity, which policy, and which tool. That is what the audit asks for, and it is cheaper to have it from day one.

04Refusals are loggedA blocked call is a record too. “The agent cannot do that” has to be provable, not remembered.

How Mindcat helps

Where we would start in your org.

Foundation before scale. The gateway first, then one governed worker.

Questions

What we actually say.

Can we call the model directly from the agent?: You can. You will not be able to prove who spent the tokens or which policy applied. We will not sign that as production.
Is this only a MuleSoft answer?: No. The plane is the requirement. Flex Gateway and Agent Fabric are how we usually build it in a Salesforce estate. An API gateway you already run can hold the same controls if it can do identity exchange and audit.
How do you handle MCP tools?: As a catalogue with entitlements per caller, served through the gateway. We will build that pattern in your org: a tool gets a version, an owner, and a scope before an agent may call it.
Does the gateway slow every call?: It adds a hop. It also removes the incident where nobody can say which agent wrote a record. We measure the latency and tell you the trade honestly.

What to read next.

The brief

Show us what an agent can call today.

We will mark the hops with no identity, and the ones that should not exist.

Every tool call and model call goes through one door.

flowchart TD A["Agents and applications"] --> G["Gateway: identity, policy, budget, audit"] G --> F["Frontier reasoning: Claude, OpenAI, Gemini Pro"] G --> H["High-volume extraction: fast, low-latency models"] G --> L["Local and open models in your own perimeter"] G --> T["Time-series forecasting models"]