Gustavo Norymberg
I build the enforcement layer for AI: agent gateways, identity-aware RAG, and self-hosted inference, on zero-trust foundations.
Twenty years in enterprise infrastructure and network security. Now I design and govern the agent and LLM platforms that regulated enterprises run in production.
One enforcement point for every agent action.
You cannot reliably detect every hostile instruction an agent reads. You can decide what it is allowed to do. That is the job of an enforcement point.
An open-source agent-governance gateway. It sits between AI agents and the tools, peer agents and models they call, and decides every action before it runs. Built for regulated environments where routing agent traffic through a SaaS is a non-starter.
OPA/Rego policy compiled to WASM and evaluated in-process. An unknown tool, peer or model is denied without a rule needing to exist.
The gateway injects a scoped backend credential only after policy allows the call. A stolen agent key cannot reach the backend token.
Every allow and every deny is recorded in a hash chain. An edited, deleted or reordered record is caught on verification.
Unknown caller, policy error or upstream failure returns a denial plus an audit record. No path turns an error into an allow.
Four governed planes: agent ingress · agent-to-agent delegation · MCP tool egress · LLM upstream
- Context
- aegis injects a scoped backend credential into each agent call only after policy allows it, so the agent never holds the secret. The finding below was caught in review inside the pull request, before the code reached the main branch. It never shipped in a release.
- The finding
- The first cut of the planes let the caller name the upstream URL in the request body. An authenticated agent with one allowlisted tool could point the gateway at a server it controlled and receive the injected credential. The agent never held the secret. It made the gateway deliver it anywhere, which is the same thing.
- Root cause
- The trust boundary covered the credential but not where the credential goes. The destination carries authority too. The same class of bug appeared once more on the LLM plane: a caller-supplied payload overrode the policy-approved model, so the audit named the wrong model and cost was metered at the wrong rate.
- The fix
- Destinations now resolve server-side from the operator-registered agent and target record. The caller names a tool, peer or model, the gateway decides where it goes, and denies when nothing is registered. Redirects are rejected. Trusted values are applied last. Both fixes are locked by regression tests that were verified to fail when the fix is reverted.
- Lesson
- Least privilege covers every input that carries authority: the secret, where it is sent, and which model runs.
AI platforms, and the foundations underneath them.
Selected engagements from enterprise delivery. Clients are not named.
Enforcement gateway for AI-agent traffic
Built on Azure API Management: fail-closed JWT validation, app-role authorization, per-agent rate limiting, managed-identity backend auth, and every deny audited. Terraform on Azure Verified Modules, CI-gated.
Identity-aware retrieval
Document-level security trimming with Entra ACLs enforced at retrieval, keyless and deny-by-default. The same user and query get a document cited or trimmed based on a single ACL value.
Self-hosted LLM tier for a regulated fintech
Open-weight models on AKS GPU with vLLM, agent orchestration with input and output guardrails, and in-region data residency under the Israeli Credit Data Law. Full low-level design delivered.
Landing zone to production for a municipal government
CAF-aligned design on the ALZ Accelerator with the Sovereignty Baseline, Microsoft Cloud Security Benchmark and Defender for Cloud, all in Terraform. Governance measured at CAF 85% across 380 policy assignments.
Multi-agent delivery toolchain
An internal toolchain of 7 purpose-built MCP servers and 50+ skills that produces customer deliverables and a reconciled billing-automation pipeline.
Datacenter operations for a national telecom
Owned hosting, co-location and datacenter operations around the clock. Led 4 teams, 27 people. Consolidated 4 facilities into 2 and re-platformed the network core with minimal customer downtime.
The governance model, in code you can read.
agent-gateway-apim
The same governance model as an Azure API Management deployment: Terraform/AVM, Entra app-only identity, validate-JWT, managed identity to the backend. CI-validated and deploy-proven.
View repository →agent-gateway-a2a
The HLD, LLD and threat model the gateway work is built on: one governed action surface, least-privilege persona tokens, propose then confirm on writes.
View repository →mcp-agent-starter
A minimal MCP server with the security model production agents need: per-agent least privilege, an audit log, and a human-confirm gate on writes.
View repository →azure-ai-platform-reference-architecture
A reference pattern for agentic AI on Azure, with a hands-on RAG security-trimming lab that proves retrieval under the user's own identity, including the real failure modes.
View repository →agent-knowledge-base
An agent-readable knowledge base with a stdlib indexer that lints, chunks for RAG, and emits a capability map.
View repository →My R&D lab: where I test it before I recommend it.
Three nodes I built and run 24/7, solo: two Proxmox hypervisors and a Mac Studio (M1 Max, 64GB) as the local inference node. Local multi-modal model serving, a cost-aware model router, agent automation, zero-trust identity at the edge, and observability with an off-cluster watchdog.
Drives the platform out of band, so all of it can be operated hands-free.
Agents that route, gate and self-check, built to run unattended.
The cheapest capable model per task.
Cited retrieval over a private knowledge base.
Four rules I hold every system to.
Two independent sources and a math sanity check before any number ships.
Fixture, canary, wave, soak. A fix never goes straight to a big batch.
Extend proven infrastructure. Never a parallel rebuild.
Anything a system must never do belongs in an enforced control that holds even when the model misbehaves.
Open to Principal and Staff AI architect roles.
If you are building serious AI infrastructure and want someone who designs it, governs it and ships it, let's talk.