Scope boundary

Owns routing-time selection of model endpoints and regions that satisfy data residency, sovereignty, data-zone, retention, and provider-training restrictions already attached to an authorized inference request.

AID-H-029.002: AID-H-033.003 selects which endpoint or region may process data already authorized for inference; AID-H-029.002 decides whether the data may enter the inference stage at all. Stage authorization must precede route eligibility.

AID-I-002.002: AID-H-033.003 makes the policy-layer endpoint and region choice; AID-I-002.002 enforces network-layer destination reachability. Routing policy and egress enforcement must agree but are not the same decision.

AID-H-032.001: AID-H-033.003 governs geographic and legal compatibility; AID-H-032.001 governs shared versus dedicated capacity for tenancy isolation. A route may satisfy residency while failing the required isolation tier.

Implementation guidance

• AID-H-033.003-G001: Attach data-zone and retention labels to requests and block routing to endpoints whose residency or retention profile is incompatible.

AID-H-033.003-G001

Concept:

Routing decisions must respect the request's data-zone, allowed-region, retention, and training-use labels before a backend is selected. These labels are routing preconditions, not after-the-fact audit tags.

Step 1: Carry policy labels on every request

{
  "request_id": "req-123",
  "data_zone": "eu-regulated",
  "allowed_regions": ["eu-west-1", "eu-central-1"],
  "retention_class": "no-training",
  "train_on_customer_data": false
}

Step 2: Evaluate backend compatibility before selection

# File: routing/select_region_safe_backend.py
from __future__ import annotations


def backend_is_compatible(request_labels: dict, backend_profile: dict) -> bool:
    if backend_profile["region"] not in request_labels["allowed_regions"]:
        return False
    if backend_profile["retention_class"] != request_labels["retention_class"]:
        return False
    if backend_profile["train_on_customer_data"] != request_labels["train_on_customer_data"]:
        return False
    return backend_profile["data_zone"] == request_labels["data_zone"]

Step 3: Verify routing rejections

When all candidate backends fail compatibility checks, emit a structured rejection record that captures the incompatible field rather than falling back to a looser region or retention profile.

Action: Make region, residency, and retention compatibility a hard routing gate. If the backend profile does not match the request labels, block the route.

Keep the action safely bounded

Reconcile the complete population of every labeled request and every candidate/effective endpoint considered for it; reject expired, revoked, or stale policy and asset bindings under the policy-defined freshness window.

Verify safely

A separately credentialed verifier independently replays label provenance, candidate compatibility, DNS/endpoint region, provider profile and effective route with forged label, unknown region, changed retention/training-use, failover, and profile-expiry fixtures, reads back effective state from the enforcement system, exercises positive, negative, boundary, stale-evidence, and dependency-failure fixtures, and reconciles every eligible item.

Open-source tools

• Open Policy Agent (OPA)
• OpenTelemetry
• Envoy Proxy

Commercial / hosted tools

• Microsoft Foundry (signed endpoint handling profile remains authoritative)
• Azure API Management (routing only; signed endpoint handling profile required)
• Cloudflare AI Gateway (routing only; signed endpoint handling profile required)
• Google Cloud Apigee API Management (policy-based regional routing)

Threat mappings

MITRE ATLAS

• AML.T0025 Exfiltration via Cyber Means (routing to an unapproved region or provider transmits protected request data outside its boundary)

MAESTRO

• Data Exfiltration (L2)
• Data Leakage (Cross-Layer)

OWASP LLM Top 10 2026

• LLM02:2026 Sensitive Information Disclosure

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• N/A

NIST Adversarial Machine Learning 2025

• N/A

Cisco Integrated AI Security and Safety Framework

• AITech-8.2 Data Exfiltration / Exposure (blocks inference dispatch outside approved region and data-handling constraints)
• AITech-8.3 Information Disclosure (blocks inference dispatch outside approved region and data-handling constraints)

Google Secure AI Framework 2.0 - Risks

• SDD: Sensitive Data Disclosure
• EDH: Excessive Data Handling

Databricks AI Security Framework 3.0

• Model Serving - Inference requests 9.10: Accidental exposure of unauthorized data to models