AID-H-033: AI Gateway Routing Integrity & Policy-Preserving Failover

Version 1.20261015 · Family — navigation only

Treat the AI gateway or model router as a security control plane, not merely a latency or cost optimization layer. This technique governs how requests are bound to approved models, providers, regions, remote MCP/A2A endpoints, and fallback paths so that routing changes do not silently weaken safety, compliance, data residency, retention, or approval constraints.

Coverage includes:

Preserving protected, durably acknowledged requested-versus-effective route provenance across every dispatch attempt and observed terminal state.
Preventing silent failover to unapproved or less-safe models.
Constraining routing by region, data zone, residency, and retention policy.
Versioning, approving, canarying, and rolling back route policy bundles as security artifacts.
Resolving and enforcing the final provider route immediately before dispatch.
Resolving and enforcing effective sampling, output, log-probability, and provider safety-profile settings immediately before provider serialization.

Scope boundary

Owns the AI gateway or model router decision plane: protected route provenance, policy-preserving fallback, routing policy lifecycle, final route eligibility enforcement, and invocation configuration. Its children separate durable record custody from route allow/deny; independent drift detection is owned by AID-D-004.006. It does not resolve tools or authorize their effects.

AID-H-024: AID-H-033 resolves model-provider routes and invocation settings; AID-H-024 resolves tool and MCP identities, versions, descriptors, and contracts. Both are resolution controls, but over different namespaces and dispatch targets.

AID-I-002.002: AID-H-033 decides which model endpoint is policy-eligible and should receive the request; AID-I-002.002 decides which external destinations are reachable at the network boundary. An eligible route still requires network enforcement, and a reachable endpoint is not necessarily an approved route.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0010 AI Supply Chain Compromise
AML.T0025 Exfiltration via Cyber Means
AML.T0029 Denial of AI Service
AML.T0034 Cost Harvesting

MAESTRO

Denial of Service (DoS) Attacks (L1)
Data Exfiltration (L2)
Denial of Service on Framework APIs (L3)
Integration Risks (L7)
Supply Chain Attacks (Cross-Layer)
Data Leakage (Cross-Layer)

OWASP LLM Top 10 2026

LLM02:2026 Sensitive Information Disclosure
LLM03:2026 Excessive Agency
LLM04:2026 Supply Chain
LLM06:2026 Unbounded Consumption

OWASP ML Top 10 2023

ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities
ASI08:2026 Cascading Failures

NIST Adversarial Machine Learning 2025

NISTAML.014 Energy-latency

Cisco Integrated AI Security and Safety Framework

AITech-2.1 Excessive Agency
AITech-8.2 Data Exfiltration / Exposure
AITech-8.3 Information Disclosure
AITech-13.1 Disruption of Availability
AITech-13.2 Cost Harvesting / Repurposing
AISubtech-2.1.2 Capability and Permission Overreach
AISubtech-10.1.2 Weight Reconstruction
AISubtech-13.1.1 Compute Exhaustion
AISubtech-13.1.3 Model Denial of Service
AISubtech-13.2.1 Service Misuse for Cost Inflation
AISubtech-14.1.2 Insufficient Access Controls

Google Secure AI Framework 2.0 - Risks

EDH: Excessive Data Handling
DMS: Denial of ML Service
IIC: Insecure Integrated Component
SDD: Sensitive Data Disclosure

Databricks AI Security Framework 3.0

Governance 4.1: Lack of traceability and transparency of model assets
Governance 4.2: Lack of end-to-end ML lifecycle
Model Serving - Inference requests 9.7: Denial of Service (DoS)
Model Serving - Inference requests 9.10: Accidental exposure of unauthorized data to models
Operations 11.1: Lack of MLOps - repeatable enforced standards