What an AI Gateway Actually Does: Routing, Security, and Data Sovereignty

·1 views

An AI gateway sits between an application and its model providers, processing requests through five stages: authentication, routing, security inspection, the upstream model call, and logging. Beyond basic proxying, a well-designed gateway handles load balancing, fallback chains, and cost-based routing to manage provider failures and reduce LLM spending without changes to application code. Security inspection at the gateway level enables prompt injection detection, PII scanning, and policy enforcement consistently across all services. A critical architectural choice is whether to use a single-process design, where traffic transits the vendor's cloud, or a split-plane design that keeps prompts within the organisation's own infrastructure. The split-plane approach is increasingly relevant as regulations like the EU AI Act, taking effect from August 2026, impose stricter obligations on data handling for high-risk AI systems.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer releases Pistachio, a declarative schema management CLI for PostgreSQL

A developer has released Pistachio, an open-source command-line tool that manages PostgreSQL schemas declaratively, similar to how Terraform handles infrastructure. Users define their desired database schema in a single SQL file, and the tool automatically computes and applies the difference against the live database using a plan-then-apply workflow. Pistachio uses PostgreSQL's own parser via the pg_query_go library, keeping it lightweight while supporting a broad range of objects including tables, views, enums, triggers, functions, and row-level security policies. The tool was created after the author found existing alternatives like sqldef and pgschema either lacked SQL compatibility or required a heavier embedded PostgreSQL setup. To adopt it on an existing database, users can run a single dump command to generate the initial schema file and manage all future changes from there.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer releases CLI tool to help JS/TS apps comply with India's DPDP Act 2023

India's Digital Personal Data Protection (DPDP) Act, 2023 is now in force, carrying penalties of up to ₹250 crore for violations such as loading trackers without user consent or storing personal data unencrypted. A developer has released an open-source CLI tool called @dpdp-india/audit that statically scans JavaScript and TypeScript codebases to flag non-compliant patterns, functioning similarly to ESLint but focused on privacy rules. The tool covers 13 rules, detecting issues ranging from unguarded Google Analytics and Facebook Pixel loads to bulk data exports lacking audit trails. It also ships with a ready-to-use Next.js consent system, including a banner component and a consent-aware script loader, so developers can remediate flagged issues quickly. The package additionally supports SARIF output for integration with GitHub Code Scanning and can be configured to fail CI builds when violations are detected.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Choose an AI Agent Governance Framework: Define Boundaries First

A governance guide published on DEV Community by MAREF architect 11-Shao argues that organizations must define their governance boundaries before selecting an AI Agent framework, not the other way around. The guide breaks Agent governance into four layers: identity and permissions, behavioral norms, audit and traceability, and policy evolution, warning that most teams focus only on the first layer. It distinguishes between two framework types — embedded governance, which intercepts Agent actions in real time, and bypass governance, which operates as an external service — recommending each for controlled and open environments respectively. Five evaluation criteria are outlined, including native support for human-in-the-loop approvals, separation of policy from code, causal completeness of audit logs, multi-Agent isolation, and a defined failsafe mechanism. The author notes that MAREF uses LangGraph for its core decision pipeline due to its state-machine model and interrupt mechanism, while supplementing it with an external governance layer for untrusted environments.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Writer shares experience of burning out despite working only three days a week

A personal essay published on jennywanger.com explores how the author experienced burnout even while working a reduced three-day week. The piece challenges the common assumption that shorter working hours automatically prevent exhaustion or overwork. The author reflects on the factors that contributed to their burnout despite having more free time than a typical full-time worker. The article has gained modest attention on Hacker News, prompting discussion about the nature of burnout beyond just hours worked.

0 comments Read more at Hacker News