Scope boundary

Owns versioning, signing, approval, canary rollout, rollback, and readback of AI gateway route-policy bundles, including model sets, fallback graphs, regional constraints, and route-specific safety requirements.

AID-M-005.002: AID-H-033.004 governs runtime route-policy bundles consumed by the AI gateway; AID-M-005.002 governs infrastructure security baselines and posture manifests. The same release pattern applies to different artifact classes and enforcement points.

AID-H-021.002: AID-H-033.004 governs route bundles and their staged rollout; AID-H-021.002 protects signed agent prompts and configuration artifacts. Shared signing infrastructure does not merge ownership of gateway routing and agent configuration.

AID-H-033.005: AID-H-033.004 publishes the approved route contract; AID-H-033.005 resolves each request against that contract at the final dispatch point. A signed bundle is not enforcement until the effective route is read back and checked.

Implementation guidance

• AID-H-033.004-G001: Store route policy bundles in version control, require approval for changes, canary high-risk routing changes, and support immediate rollback.

AID-H-033.004-G001

Concept:

Route bundles are security artifacts. They should be versioned, signed, reviewed, canaried, and rolled back exactly like firewall or admission policy, not treated as ad-hoc application config.

Step 1: Version the route bundle and publish a signed manifest

{
  "bundle_version": "2026.04.12-1",
  "policy_path": "routing/bundles/2026.04.12-1.rego",
  "approvers": ["platform-security", "ai-governance"],
  "rollout_mode": "canary"
}

Step 2: Canary the bundle before full promotion

# File: routing/canary_bundle.py
from __future__ import annotations

import json
from pathlib import Path


manifest = json.loads(Path("routing/route_bundle_manifest.json").read_text(encoding="utf-8"))
print({"bundle_version": manifest["bundle_version"], "rollout_mode": manifest["rollout_mode"], "status": "canary_started"})

Step 3: Roll back on safety or mismatch spikes

Track route-decision mismatches, moderation regressions, or policy evaluation failures against the active bundle version. If those signals spike during canary, immediately restore the prior approved bundle version.

Action: Keep route bundles in version control with explicit approval and rollback records. High-risk routing changes should never jump directly to full production rollout.

Keep the action safely bounded

At the CI release gate, canary router, and runtime bundle loader before a route revision becomes authoritative, bind a signed, versioned policy (policy version and SHA-256 digest) to the exact asset_id and asset version for route bundle, schema, source revision, signer and trust root, test suite, canary cohort, rollback target, gateway release, and runtime instance inventory. Reconcile the complete population of every bundle change, required policy test, canary decision, runtime instance, and rollback/readback target; reject expired, revoked, or stale policy and asset bindings under the policy-defined freshness window.

Verify safely

A separately credentialed verifier independently replays source-to-bundle provenance, tests, canary metrics/decisions, activation and rollback with tamper, missing approval, stale signer, mixed fleet, bad canary, loader outage, and rollback fixtures, reads back effective state from the enforcement system, exercises positive, negative, boundary, stale-evidence, and dependency-failure fixtures, and reconciles every eligible item.

Open-source tools

• Git
• Open Policy Agent (OPA)
• Argo Rollouts

Commercial / hosted tools

• GitHub Enterprise
• Azure DevOps
• LaunchDarkly

Threat mappings

MITRE ATLAS

• AML.T0010 AI Supply Chain Compromise (tampered route bundles can select an unapproved model or provider dependency)

MAESTRO

• Supply Chain Attacks (Cross-Layer)
• Integration Risks (L7)

OWASP LLM Top 10 2026

• LLM04:2026 Supply Chain (versioned approval and rollback protect route-policy releases that select model suppliers, while component provenance is verified elsewhere)

OWASP ML Top 10 2023

• ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

• ASI04:2026 Agentic Supply Chain Vulnerabilities

NIST Adversarial Machine Learning 2025

• N/A

Cisco Integrated AI Security and Safety Framework

• N/A

Google Secure AI Framework 2.0 - Risks

• IIC: Insecure Integrated Component

Databricks AI Security Framework 3.0

• Governance 4.2: Lack of end-to-end ML lifecycle
• Operations 11.1: Lack of MLOps - repeatable enforced standards