Can we call the model directly from the agent?

You can. You will not be able to prove who spent the tokens or which policy applied. We will not sign that as production.

Is this only a MuleSoft answer?

No. The plane is the requirement. Flex Gateway and Agent Fabric are how we usually build it in a Salesforce estate. An API gateway you already run can hold the same controls if it can do identity exchange and audit.

How do you handle MCP tools?

As a catalogue with entitlements per caller, served through the gateway. We will build that pattern in your org: a tool gets a version, an owner, and a scope before an agent may call it.

Does the gateway slow every call?

It adds a hop. It also removes the incident where nobody can say which agent wrote a record. We measure the latency and tell you the trade honestly.

Control plane

Every tool call and model call goes through one door.

Identity on the hop, policy at the edge, and a trail that survives an audit. If an agent can reach a model or a tool without passing this plane, you do not have a control plane.

Get the written assessment Flex Gateway

Founded 2022 · Founder in the Salesforce MVP Hall of Fame · Dubai HQ · Kochi studio

What it is

Four controls, one hop.

The control plane is the only path from a runtime to a model, a tool, or another agent. In the orgs we work in that is Flex Gateway at the edge and Agent Fabric as the plane above it.

01On-behalf-of identityThe agent acts as the named user, with a narrower token at each hop. Not a shared service account with the permissions of everyone.

02Fine-grained authorizationRelationship-based access control so tenant, team, and record boundaries are data the agent cannot argue with. OpenFGA-style models belong here.

03Rate and budgetToken buckets per caller, per business group. A runaway loop becomes a throttle, not an invoice.

04Audit and semantic policyDenied topics, field-level redaction, and prompt-side checks at the edge rather than buried in application code.

Why it matters

Without it you cannot answer the only question that matters.

Your auditor, your CFO, and your incident review all ask the same thing: who wrote that record, under whose authority, and what did it cost? Four things have to be true before you can answer.

Without it, with it

Many side doors, or one front door.

Without this plane

With it

Each agent holds its own credentials: One gateway carries the person’s identity
Logs say ‘integration user’: Logs name who asked and what was called
Spend is a surprise at month end: Spend visible per caller
Listing a tool is the same as calling it: Discovery and permission kept apart

Model routing

One door in front of several models.

Routing is a control decision, not a feature of whichever SDK the last engineer liked. The gateway is where the choice, the budget, and the audit live together.

01
High-stakes reasoning
Legal, financial, and architectural judgement goes to a frontier model. We will name which, and why, in writing.
02
High-volume extraction
Classification and intermediate transforms go to a fast model. Paying frontier prices for a field lift is a design error.
03
Sovereign workloads
Open models such as Gemma or CodeGemma inside your own cluster when code or records cannot leave the perimeter.
04
Numbers, not prose
Forecasting belongs to time-series models such as Google TimesFM. A language model guessing at a trend is not a forecast.

Model routing behind the gateway. Frontier reasoning for high-stakes work, a fast model for high-volume extraction, a local open model where data cannot leave the perimeter, and a dedicated forecasting model for numbers.

Mermaid source

flowchart TD
  A["Agents and applications"] --> G["Gateway: identity, policy, budget, audit"]
  G --> F["Frontier reasoning: Claude, OpenAI, Gemini Pro"]
  G --> H["High-volume extraction: fast, low-latency models"]
  G --> L["Local and open models in your own perimeter"]
  G --> T["Time-series forecasting models"]

In an org

A bank or an insurer.

Regulated, multi-tenant, and audited. The control plane is the reason the programme is allowed to exist.

01The agent is the officerA case agent acts on behalf of the named officer and can only see what that officer could see. The graph of entitlements says no before the model does.

02Tools behind one doorPolicy documents, core banking reads, and the knowledge base are tools in a catalogue, entitled per caller, served through the gateway.

03Evidence, not assuranceEach hop leaves which identity, which policy, and which tool. That is what the audit asks for, and it is cheaper to have it from day one.

04Refusals are loggedA blocked call is a record too. “The agent cannot do that” has to be provable, not remembered.

Who calls us

Three desks that needed one door.

Typical control-plane gaps, in the buyer’s words.

Example
CTO, Riyadh consumer lender
Today: A collections agent and a service agent both reach core banking. The auditor asks which one may see a credit limit.
After: Both reach it through one gateway, entitled per caller, and a refused call is logged as well.
For CTOs
Example
Head of claims, Dubai motor insurer
Today: A claims assistant looped all weekend. The model bill was the first alert.
After: A budget per caller sits at the edge, so a runaway loop becomes a throttle, not an invoice.
Flex Gateway
Example
Compliance lead, Abu Dhabi private bank
Today: Client names and account numbers reach the model inside prompts.
After: Field-level redaction and denied topics run at the edge, not in each agent’s prompt.
Banking and finance

Examples of the work, not case studies. Roles and cities are typical of the desks we see.

How Mindcat helps

Where we would start in your org.

Foundation before scale. The gateway first, then one governed worker.

Questions

What we actually say.

Can we call the model directly from the agent?: You can. You will not be able to prove who spent the tokens or which policy applied. We will not sign that as production.
Is this only a MuleSoft answer?: No. The plane is the requirement. Flex Gateway and Agent Fabric are how we usually build it in a Salesforce estate. An API gateway you already run can hold the same controls if it can do identity exchange and audit.
How do you handle MCP tools?: As a catalogue with entitlements per caller, served through the gateway. We will build that pattern in your org: a tool gets a version, an owner, and a scope before an agent may call it.
Does the gateway slow every call?: It adds a hop. It also removes the incident where nobody can say which agent wrote a record. We measure the latency and tell you the trade honestly.

From the blog

Can you stop an agent in two hours?

UAE CIO data, what DIFC Regulation 10 adds, and a five-step stop drill.

AI agent kill switch: the UAE gap
How fast UAE CIOs say they could contain a bad agent, the four levers that stop one, and the drill.

The brief · one email

Show us what an agent can call today.

We will mark the hops with no identity, and the ones that should not exist. The assessment is free: a short read of the org and a written note. If you go ahead, the first build week is a fixed AED/SAR 14,900 (about USD 4,050), credited in full when you sign the build within 60 days. The honest no: if the work is a software factory with a named delivery date, we are the wrong partner.