Consus Blog

Secure AI Routing and Gateways for DoW Contracts

Defense contractors need production AI access without exposing Controlled Unclassified Information (CUI) to public, commercial, or non-U.S. infrastructure. Consus Gateway is built specifically for this problem. It gives defense contractors a controlled, single-API path between their applications and approved government-cloud models, enforcing routing, identity, retention, network, and evidence requirements within the contractor's documented system boundary, without months of in-house cloud integration work.

What a Secure AI Gateway Must Do for DoW Production Traffic, and How Consus Delivers It

An AI gateway is a policy and control layer through which AI traffic passes before reaching an underlying model (Government Technology Insider). It gives applications a unified interface for multiple models while centralizing routing, access control, filtering, and oversight.

The gateway, model, and cloud provider have separate roles. The gateway evaluates the request and selects an approved backend. The model processes the request through a specific cloud deployment path. The cloud provider supplies the authorized environment, network controls, location, and supporting services. Consus Gateway occupies that first role, and it is purpose-built for the defense industrial base rather than adapted from a general-purpose product.

DoW cloud contracts must include the applicable DFARS Subpart 239.76 cloud policy and contract clauses. They must also use cloud services granted a DoW provisional authorization at the Impact Level appropriate for the workload, per the DoW Cloud Security Playbook.

A production gateway should enforce approved model IDs and compliance tiers, workload identity and least-privilege access, U.S. government-cloud destinations, restrictions on tools and outbound calls, content-retention policy, fail-closed routing, audit records that exclude prompt and response content, and evidence for assessment review. Consus Gateway enforces every item on that list by default, out of the box:

A U.S. cloud region, FedRAMP authorization, or gateway deployment does not establish CMMC compliance by itself. Compliance depends on the full system boundary, the contract requirements, the selected cloud service authorization, and the controls the contractor implements and documents. That is exactly why Consus focuses on handing contractors documented evidence rather than a marketing claim of "compliance."

The CUI Request Path: From Application to Approved Model and Back, Through Consus

The production path should make every routing and authorization decision explicit before CUI reaches a model. Public AI is a blocked lane for CUI. Approved workflows need reviewed environments, approved model lanes, constrained connectors, retention controls, logging, and human review (GS Consulting). Consus Gateway is designed to sit exactly at this chokepoint.

The controlled request flow through Consus is:

  1. Client or application (your existing OpenAI-compatible client, unchanged)
  2. Request classification and identity (your application layer)
  3. Gateway policy enforcement (Consus: model ID, compliance tier, tool schema validation)
  4. Authorized model ID and compliance-tier decision (Consus: bound at the request boundary)
  5. Approved U.S. government-cloud model endpoint (Consus: AWS GovCloud, GCP Assured Workloads, or Azure Government, router-selected)
  6. Response return (Consus: zero-persistence, ephemeral memory only)
  7. Audit and billing metadata (Consus: API key ID, model name, token counts, latency, never content)

1. Classify the Request Before It Leaves the Application

The application should identify the request's data class and authorized workflow before transmission. Classification should cover prompt text, uploaded files, retrieved documents, system instructions, tool arguments, and any prior conversation included as context.

The request should also carry a verifiable workload or user identity. That identity lets the gateway apply policies based on the program, role, data class, approved use case, and destination. If the application cannot determine whether content contains CUI, it should route the request for review or reject it rather than assign a lower classification.

Source classification remains necessary even when the gateway runs DLP inspection. Consus does not perform content classification. It is intentionally a routing and boundary-enforcement layer, not a content scanner, so this step stays owned by the application and data owner, who have the mission context needed to classify the information correctly.

2. Enforce Policy at the Gateway Boundary, Where Consus Does the Heaviest Lifting

The gateway checks the request before it contacts a model. Consus Gateway verifies the caller (via API key), the requested model and compliance tier, and every tool definition, against an approved policy, before the request ever reaches a provider.

A request that fails those checks stops at the gateway. Consus does not repair an unauthorized request by silently sending it to a general commercial endpoint or a model with a lower authorization level. A malformed or under-specified model ID is rejected outright, not downgraded.

Central enforcement also reduces policy differences between applications. Because Consus Gateway speaks the OpenAI-compatible API, teams get a common interface: the OpenAI SDK, LangChain, LlamaIndex, LiteLLM, Claude Code, Codex CLI, Cline, OpenCode, VS Code Copilot. Consus then applies consistent routing and deny rules across coding assistants, retrieval workflows, document analysis, and other production services.

3. Authorize the Model and Compliance Tier

A model name alone does not identify an acceptable deployment path. The gateway must bind the requested model ID to a specific provider, cloud environment, compliance tier, and endpoint.

Consus Gateway authorizes each request against the selected model ID directly in the ID string. Its routing configuration sends requests marked :il5+itar to an ITAR-authorized provider using Amazon Bedrock in AWS GovCloud, :fedramp-high to the appropriate FedRAMP High backend, and a bare :itar suffix to a model's ITAR-authorized provider without requiring a separate FedRAMP or DoW IL declaration. This is enforced at the API validation layer: a request with no compliance suffix is rejected with a 400 error before it goes anywhere.

For teams asking how to keep AI model traffic within U.S. borders for DoW contracts, this is the answer: Consus combines an approved model ID with a documented compliance tier and U.S. government-cloud endpoint in a single request parameter, so there is no unrestricted model alias that can resolve to different providers or regions.

Authorization also accounts for the caller's role and program. A model available to one contract or data type may be unavailable to another because the workloads have different Impact Level, export-control, contract, or data-handling requirements. Consus's model catalog, which records the FedRAMP, DoW Impact Level, and ITAR ceiling for every model and provider pair, makes that distinction explicit rather than leaving it to application-level guesswork.

4. Route Only to the Approved U.S. Government-Cloud Backend

Consus routes exclusively to government-cloud infrastructure and authorization environments across GCP, AWS, and Azure. There is no commercial-cloud routing configuration to misconfigure.

The contractor must still confirm that the selected service, model, cloud path, and authorization match the workload. Availability through a government cloud does not make every model or configuration suitable for every contract. Consus's model catalog lists the authorization ceiling for every model/provider pair so this confirmation is a lookup, not a research project.

5. Return the Response Without Persisting Content

Consus Gateway processes prompts and model responses entirely in ephemeral container memory. It does not write that content to disk, logs, or any persistent data store.

The response returns through the gateway to the calling application. The application then applies its own output controls, including classification, access restrictions, human review, storage policy, and delivery rules.

Zero persistence at the gateway does not control downstream storage. The client, retrieval system, observability platform, browser, and destination repository can still retain CUI unless the workflow configures them correctly. Consus removes the gateway itself as a place CUI can pool, which is one fewer system your team has to secure and evidence.

6. Retain Evidence Without Retaining Prompt Content

Operational evidence should show which identity used an approved route, which model handled the request, and whether policy enforcement succeeded, without copying prompts and responses into general-purpose logs.

Consus Gateway retains billing metadata limited to the API key ID, model name, token counts, and latency. Prompt and response content stays outside those billing records entirely.

This separation supports investigation and capacity management without creating a large repository of sensitive AI conversations. Contractors should still classify operational metadata and restrict it when model choices, timing, user identities, or workflow patterns could reveal sensitive program information.

How Consus Keeps Production AI Traffic Inside the U.S. Boundary

Keeping AI traffic within U.S. borders requires an allowlist of model IDs, compliance tiers, government-cloud environments, regions, and endpoints. The gateway must deny other destinations and prevent silent fallback to commercial or foreign infrastructure. This is the core design premise of Consus Gateway, not an add-on feature.

Geographic location is one part of the decision. Contractors must also evaluate service authorization, identity, network path, retention, model-training settings, logging, encryption, and contract requirements.

Define the Allowed Destinations

Create an inventory that maps each approved model ID to its provider, cloud environment, region, Impact Level, export-control status, endpoint, and permitted data class. Treat an alias or model version change as a routing change that requires review. Consus's model explorer already maintains this mapping for every model it serves, filterable by DoW Impact Level, FedRAMP level, ITAR authorization, and model maker, so contractors inherit a maintained inventory rather than building one from scratch.

CUI for National Security Systems must use cloud service offerings authorized for IL5 or higher, including appropriate U.S. Government Clouds, matching the workload's Impact Level under the DoW cloud authorization requirements.

DNS names and region labels provide incomplete assurance. Validate the service offering, contract terms, tenant configuration, model deployment, network path, support access, and data-processing commitments. Consus's security documentation publishes this detail per cloud rather than leaving it to be inferred.

Prevent Fallback to Commercial or Non-U.S. Infrastructure

Remove generic provider endpoints from production configuration. Restrict egress so applications can reach the gateway while the gateway can reach only approved backends. There is no configuration in Consus Gateway that routes traffic to a commercial cloud region. This is not a setting to disable. It does not exist.

Fallback routes need the same review as primary routes. Document each alternative provider, model, region, authorization, and data-handling policy before enabling it. A technically compatible public endpoint is not an acceptable emergency route for CUI.

Control model aliases at the gateway rather than leaving provider selection to individual applications. This prevents an application update from redirecting production traffic outside the approved boundary. With Consus, that control point is the compliance suffix on the model ID itself, enforced server-side.

Fail Closed When the Approved Route Is Unavailable

Reject the request when the approved model, provider, region, or compliance tier is unavailable. Consus Gateway is a proxy, not an improvising router: it does not select another destination unless policy explicitly approves that complete route, and a bare model name with no compliance suffix is rejected outright rather than routed by default assumption.

The failure response should identify a policy or availability condition without returning sensitive request content. Consus sanitizes provider error messages before returning them: embedded provider text is stripped and replaced with a canned message, and the raw error is logged only server-side, never surfaced to your application. Monitoring should alert the appropriate operations and security teams when repeated failures affect a production workflow.

Document how the application handles rejected requests. Queues, retries, debugging systems, and support tickets must preserve the same CUI protections as the original request.

Verify the Boundary Continuously

Consus routes AWS service traffic through VPC endpoints using PrivateLink, keeping that service traffic within the private network end to end. Its cloud resources use customer-managed encryption keys through AWS KMS in GovCloud, Cloud KMS in GCP, and Azure Key Vault in Azure Government.

Teams should validate these boundary records during deployment and after relevant changes:

Test the controls rather than relying only on configuration screenshots. Attempt requests to prohibited models, unsupported tiers, unapproved tools, and disabled destinations. Confirm that each test fails without transmitting content outside the authorized path. Consus's own governance layer generates an audit event (tool_call_governance_flag) for exactly this kind of flagged attempt, so a test failure is also a documented one.

CMMC Assessment Boundary: The Three Questions to Answer Before Sending CUI

AI services that process, store, or transmit CUI belong within the applicable assessment and cloud-usage boundary. The boundary should include AI components, interfaces, identities, cloud services, logs, connectors, retrieval systems, and data stores (Cloud Security Alliance).

An SSP owner and system architect should resolve three questions: whether the tool can interact with CUI, where that information travels and persists, and whether the selected deployment path fits the workload. Consus Gateway narrows the second question significantly, because its zero-persistence design means there is no gateway-side content store to document, diagram, or defend in an assessment.

Can the AI Tool Interact With CUI?

Start with the use case rather than the product name. Determine whether users can type CUI into the interface, attach protected files, retrieve controlled documents, expose CUI through a connector, or send generated output into a covered system.

Document the workflow purpose, users, data owners, source systems, allowed inputs, expected outputs, and human review requirements. Include both intended behavior and predictable misuse, such as copying content into a coding assistant or connecting an agent to a broad document repository.

Apply least privilege, MFA, role-based access, system segmentation, encryption, auditability, incident response, supplier risk management, configuration management, and documented reviews. Consus's controls support this work: Workload Identity Federation, FIPS 140-2 endpoints, customer-managed encryption, and tool-schema screening. They do not transfer all contractor obligations to the vendor; that split of responsibility is documented explicitly in Consus's customer-responsibility guidance rather than left implicit.

Where Is CUI Processed, Transmitted, and Stored?

Document the complete AI data path before approving the workflow:

A cloud service offering used for CUI must have a DoW provisional authorization or authorization to operate for the selected Impact Level. The review should cover every service that receives or retains the data, including observability, retrieval, support, and backup systems. For the gateway hop specifically, Consus's documented architecture of AWS GovCloud, GCP Assured Workloads, and Azure Government with zero content persistence gives a reviewer a short, complete answer instead of an open-ended investigation.

Data-flow documentation should distinguish transient processing from storage, and identify derived artifacts such as embeddings, summaries, cached responses, and retrieval logs, because they can preserve information from the source material. None of those derived artifacts exist at the Consus layer, since nothing is cached or logged beyond billing metadata. That risk surface is entirely in the contractor's own application stack.

Does the Deployment Path Match the Workload?

The best AI gateway for defense contractors that need CMMC compliance is one that supports the contractor's required deployment paths, enforces the documented boundary, and produces usable control evidence. Consus Gateway is built to meet exactly that bar: multi-cloud government routing, enforced compliance tiers, and SSP/POA&M evidence, in one product. The decision still depends on the contract, data type, Impact Level, architecture, and implemented controls.

The following table is an operational comparison. It is neither legal advice nor a certification matrix.

Deployment Path Suitable Data and Use Case Authorization and Boundary Considerations Routing and Control Requirements Where Consus Fits
Commercial/public AI Sanitized, non-sensitive data in a separate experimentation environment Keep CUI and FCI outside the service and outside connected tools or logs Block CUI routes; separate identities and environments; apply DLP and connector restrictions Not applicable. Consus has no commercial-cloud route to configure or misconfigure
Government-cloud AI Approved CUI workloads where the selected service and contract requirements align Include relevant components in the system boundary; verify the cloud authorization and contract terms Route only to approved government-cloud endpoints; enforce identity, retention, logging, encryption, and fail-closed rules Consus's default and only mode of operation
IL4/IL5-or-higher path Workloads requiring the applicable DoW Impact Level Use a service with a DoW provisional authorization or authorization to operate at the selected Impact Level Bind the model ID to the approved tier, provider, environment, endpoint, network path, and data policy Built into the model ID (:il4, :il5, :il5+itar), enforced server-side

Security Controls at the Gateway Boundary

User training can reduce accidental disclosure, but production controls must enforce policy at the point where requests leave the application. Consus Gateway is designed to reject unauthorized identities, models, compliance tiers, tools, and destinations before a provider receives the content.

Identity and Short-Lived Credentials

Consus holds no static cloud credentials. Access to GCP and Azure uses short-lived, federated workload identity, and the Azure OpenAI endpoint accepts traffic only from the gateway's own egress IP.

Workload identities should map to approved applications and services rather than shared user keys. Restrict each identity to the models, routes, connectors, and administrative actions required for its workflow. Revoke or rotate application access when the owner, contract, or system role changes. Consus rotates keys periodically as standard operational security and can disable a compromised key within minutes on request.

Approved Tools and Outbound Destinations

AI tools and agents can send data beyond the selected model endpoint. A tool schema may define web requests, database operations, email actions, file transfers, or calls to external services.

Consus inspects every tool schema at the request boundary and rejects schemas that describe outbound destinations with a 400 invalid_request_error. Property names like destination_url, webhook_url, callback_url, forward_to, send_to, and post_to are treated as the shape of an exfiltration tool and refused, and the check walks the full JSON Schema tree so a nested property or $defs entry cannot hide it. At the response boundary, tool calls that carry an outbound destination in their arguments are flagged with an advisory x_consus_governance field, with an audit event recorded server-side for every flag. The gateway's customer-responsibility guidance explains this two-layer design and why customers must also control approved tools and connector destinations on their own side.

Maintain an allowlist for plugins, tools, connectors, source repositories, and destination systems. Restrict connector scopes to the required records and actions. Prompt and file-upload DLP, approved source systems, and human review add protection, but they do not replace authorized routing. With Consus, that routing layer is already doing schema-level and response-level exfiltration screening most gateways skip entirely.

Data Retention, Encryption, and Network Controls

Set retention and model-training options for every service in the path. Review the model provider, gateway, application, retrieval layer, monitoring platform, and support systems separately because each component can have different storage behavior. On the Consus side, this review is short: zero persistence of prompt and response content, full stop.

Encrypt stored data with controlled keys and restrict key administration. Consus enforces TLS 1.2+ on every connection, FIPS 140-2 validated endpoints by default, and customer-managed keys at rest (AWS KMS for GovCloud, Cloud KMS for GCP, Azure Key Vault for Azure Government). Use private network paths where the cloud service supports them: Consus itself runs on ECS Fargate in private VPC subnets with no inbound path from the internet, with AWS service traffic routed through PrivateLink.

Document deletion, backup, cache, and recovery behavior. Zero persistence in one component does not remove copies held by the application, a file store, a vector database, or an observability service. Consus removes exactly one link in that chain, completely, and the rest remains the contractor's to document.

Logging That Supports Investigation Without Capturing CUI Content

Investigation logs should record identity, time, policy decision, approved model route, administrative change, authentication event, and error condition, while avoiding full prompts, files, retrieved passages, and responses in general application or debugging logs.

Consus retains AWS API Gateway access logs for 365 days and application logs for 365 days (NIST 800-53 AU-11, which maps to NIST 800-171 3.3.1 and CMMC practice AU.L2-3.3.1), exports GCP Vertex AI and IAM Data Access audit logs to a dedicated GCS bucket with a three-year retention lock, and keeps Azure diagnostic logs (Audit, RequestResponse, Trace) for 365 days in Log Analytics. Every one of those logs is KMS-encrypted and carries only operational metadata, never prompt or response content. Contractors should align access to those records with their own investigation, contract, and system-boundary requirements.

Retrieval records, embeddings, vector-store entries, metadata, and logs derived from CUI may remain sensitive even when they omit the original document. Classify those artifacts, restrict access, encrypt storage, and include them in incident response and disposal procedures. Again, this is downstream of Consus and stays the contractor's responsibility.

Before Sending CUI: A Production Readiness Checklist

Use this checklist before authorizing a production workflow that can process, transmit, or store CUI. Each item notes whether Consus Gateway covers it by default or the application owns it.

A secure retrieval-augmented generation workflow must preserve source permissions and protect the vector database. Separate indexes where program or data boundaries require it. Filter documents before adding them to model context, log retrieval activity, classify outputs, and provide sources for human verification.

Consumer and public AI tools should not receive CUI or FCI. Teams can use sanitized, non-sensitive data in a separate experimentation environment with distinct identities, connectors, and storage.

Complete technical tests before approval. Verify denied routes, unavailable-provider behavior, unauthorized connector requests, excessive permissions, logging exclusions, and emergency shutdown procedures with representative data that does not create a new disclosure risk.

Evidence to Retain for CMMC and Contract Review

Assessors and contract stakeholders need evidence that routing and security controls work in practice. A vendor statement, product name, or cloud-region label does not demonstrate the contractor's complete implementation.

Contractors remain responsible for system-specific decisions, evidence, and controls. Vendor documentation can support an SSP and assessment package, but it does not replace them. That is exactly the role Consus's evidence is designed to play.

Architecture and Data-Flow Evidence

Retain the current architecture diagram or equivalent system record, the system-boundary definition, and complete AI data flows, showing applications, gateways, identity systems, cloud services, model endpoints, connectors, logs, retrieval components, data stores, and output destinations. Consus publishes its own architecture and data-flow diagram as part of its security documentation, which a contractor can incorporate directly into this evidence rather than reverse-engineering it.

Record where CUI enters the workflow and where processing, transmission, or storage occurs, including transient processing, caches, embeddings, retrieval logs, monitoring data, backups, and administrative access paths.

Keep the approved workflow purpose and data classification with the architecture evidence, so reviewers can connect technical components to the contract, users, and authorized use case.

Routing, Location, and Configuration Evidence

Maintain an inventory of approved models, versions, endpoints, providers, government-cloud environments, regions, and Impact Levels. Retain the routing rules, deny policies, fail-closed configuration, and test results that show prohibited routes are blocked. Consus's model catalog is itself a maintained version of this inventory, current as of every request.

Keep cloud authorization records appropriate to the workload. Preserve U.S. location evidence, private-network configuration, endpoint policies, egress restrictions, encryption settings, key-management configuration, retention options, and model-training settings.

Document configuration ownership and the approval status of each connector. A model endpoint may remain approved while a newly added tool creates an unauthorized path outside the boundary. Consus's schema-level tool screening gives you a server-side backstop on exactly this failure mode.

Access, Monitoring, and Change Evidence

Retain identity inventories, role definitions, access reviews, MFA configuration, workload federation settings, and privileged-access records. Evidence should connect each application or user to the models and actions that policy permits.

Preserve audit-log configurations, monitoring rules, denied-request events, alerts, and investigation procedures. Include incident records and policy exceptions when they occur, along with disposition and corrective action.

Keep change records for model upgrades, new providers, region changes, routing policies, connectors, credentials, network controls, and retention settings. Test the affected controls after each material change.

Assessment Artifacts

Maintain current SSP updates, risk decisions, control mappings, procedures, test results, incident records, and exception records. Include supplier reviews and the evidence used to approve the gateway, model provider, cloud service, and connected systems.

Consus lets customers continue using existing tools and models by changing only the API base URL, which reduces application integration changes while centralizing routing policy: one line of code and no application rewrite. Its CMMC and NIST 800-171 compliance materials include SSP and POA&M evidence built specifically to support assessment work, and its compliance-framework guidance distinguishes CMMC, FedRAMP, DoW Impact Levels, and ITAR so contractors don't conflate obligations that address different things. Customers still incorporate relevant vendor evidence into their own system documentation and implemented controls, but they start from a documented baseline instead of a blank page.

A sound production decision combines an approved U.S.-only route, controls that protect CUI throughout the data path, and evidence that those controls operate as documented. Consus Gateway delivers all three as a single product, reachable through a base-URL change. Request access on the Consus pricing page. Final approval should still come from the contractor's security, contract, and compliance authorities for the specific workload.

Frequently Asked Questions

Can contractors use AI for public information, coding, internal processes, or training without exposing CUI?

Yes, if the workflow uses public or properly sanitized information and prevents access to CUI and FCI. Use a separate environment, restrict repository and connector access, and give users clear rules for source code, tickets, internal documents, and training examples that may contain contract data.

What should a contractor do if CUI is entered into an unapproved AI tool?

Stop further use, preserve the facts needed for investigation, and notify the organization's security and incident-response contacts. The contractor should follow its incident, contract, and legal procedures, determine what the provider retained or disclosed, revoke affected access where needed, and document corrective action. Because Consus retains no prompt or response content, an incident involving traffic that passed through Consus has a materially smaller retained-data question to answer than one involving a provider that logs content by default.

Do prompts, files, outputs, embeddings, and retrieval logs require the same handling when they are derived from CUI?

Treat each derived artifact according to its content and the applicable classification decision. An embedding or retrieval log may still reveal controlled facts, relationships, document identifiers, or user activity, so the data owner and security team should determine its required protection rather than assuming transformation removed the sensitivity.

Where do I start?

Request access at consus.io/pricing and follow the five-minute quickstart to route your first request through a compliant, government-cloud path. AI tokens are billed at provider list price with no markup on every plan. ITAR-only teams under 50 employees start on Teams at $40 per employee per month. Any CUI workload, or 50 or more employees, is Enterprise, priced to your size.

Read this post as Markdown