A city needs secure access patterns for permitting and 311 assistants. Which architecture decision best fits AI security design?

A city needing secure access patterns for permitting and 311 assistants should architect a private LLM gateway in front of those assistants to centralize authentication, policy, and monitoring. That architecture decision best fits AI security design because a municipal gateway becomes the control point for identity, authorization, prompt/policy enforcement, logging, rate limits, and egress to approved model hosts—preventing each assistant from inventing inconsistent, insecure access patterns.

Pointing each assistant directly at public consumer LLM endpoints with no municipal gateway fails conceptually because unmanaged direct calls bypass centralized auth, policy, and monitoring and scatter data across uncontrolled providers. Embedding unrestricted API keys in browser JavaScript for convenience fails because client-side keys are trivially extractable and enable anonymous abuse of municipal AI capacity. Bypassing network controls so assistants can call any model host anonymously fails because unrestricted anonymous egress defeats allowlisting, accountability, and data-loss prevention.

Exam caveat: a gateway concentrates risk as well as control—it must itself be hardened, highly available, and change-controlled or it becomes a single point of failure. Operational check: place permitting and 311 assistants behind the private LLM gateway only, enforce auth and policy at the gateway, deny direct public-endpoint paths, and verify keys never ship to browsers before production cutover.