LLM Gateway & Policy Engine
Server-side model authority; per-request policy decisions before infra contact.
Model access authority lives server-side. Users see only entitlement-filtered model catalogs, and every request receives its policy decision before touching infrastructure.
Hot path and policy path are separated fail-safe: a policy-engine outage does not take availability down with it.