Parks wants multimodal trail-photo AI exposed through APIs. Which architecture approach best keeps controls consistent?

Parks multimodal trail-photo AI exposed through APIs should inherit the same enterprise control plane as other civic applications. Placing the multimodal AI behind the same API gateway policies used for other city apps keeps authentication, authorization, rate limiting, logging, and threat protections consistent, reduces shadow-IT drift, and ensures photo and metadata paths are monitored like any other municipal API. Consistency matters because images and EXIF-like metadata can still disclose location, timing, and operational details. Deploying the trail-photo model on an isolated gateway with model-specific throttling rules fails because it splits the control plane, so photo traffic would not share the same authentication, authorization, rate limiting, logging, and threat protections as other civic apps and would drift from municipal policy. Publishing the photo inference schema in the developer portal with interactive trial calls enabled fails by control design—trial calls sit outside the shared gateway enforcement, so photo APIs lose the same authentication, authorization, and rate limits required of civic media APIs. Mirroring production photo requests to a staging model to validate accuracy before policy updates fails by design—accuracy checks do not place the photo API behind the same gateway policies as other civic apps, and copied production traffic may land outside consistent municipal controls. Exam caveat: Multimodal does not mean exempt; gateway parity with other civic APIs is the architecture answer. Operational check: Front the trail-photo model with the municipal API gateway, enforce authN/authZ and rate limits equal to peer apps, disable anonymous write, and ensure gateway logs feed the same SIEM pipelines.