Control CoreDocs

Agent framework connectors

Control Core governs heterogeneous agent frameworks through a single Bouncer normalization layer. Vendor-specific headers become generic policy engine input — Rego decides; the Bouncer does not branch on framework name in code.

Supported patterns

FrameworkTraffic patternBouncer placement
Salesforce AgentforcePlatform API + tool callbacksIngress reverse-proxy or API gateway next hop
Microsoft Azure AI FoundryAgent runtime → models/toolsEgress sidecar or egress reverse-proxy
LangChain / custom pipelinesApp-initiated LLM + tool HTTPEgress Bouncer on provider base URL
MCP-native agentsJSON-RPC tool protocolMCP proxy mode

Normalization produces agent_context and jit_access maps in policy engine input regardless of upstream vendor.

How to use

  1. Identify agent egress/ingress URLs — model API, tool HTTP, MCP server host (~15 min discovery).
  2. Deploy Bouncer on that path (deployment modes).
  3. Map framework attributes in PIP or request enrichment:
    • agent.framework (from header or JWT)
    • agent.capabilities[]
    • user.clearance / subject.nhi_id
  4. Apply framework-agnostic controls — one control set covers all connectors; use allowlists for capability names, not vendor SKUs.
# Example egress Bouncer for LLM providers
BOUNCER_TYPE=reverse-proxy
RESOURCE_TYPE=ai-agent
TARGET_HOST=api.openai.com:443
AI_GATEWAY_ENABLED=true
  1. Verify normalization — send sample agent request; inspect policy engine input in Audit Logs → decision detail (no vendor literals required in Rego).

How to review / audit

  • Weekly: compare agent frameworks in audit vs CMDB inventory
  • Dashboard cc-02-nhi-activity — agent identity denials by framework tag
  • Advanced AI audit for prompt/tool violation exports

Troubleshooting

Troubleshooting: Agent traffic bypasses Bouncer?

  • Point SDK base_url or HTTP client proxy at Bouncer :8080
  • For K8s, use sidecar and set HTTP_PROXY=http://127.0.0.1:8080 in agent pod

Troubleshooting: Controls not seeing framework attribute?

  • Add header→attribute mapping in Settings → Resources → Enrichment
  • Confirm AI Pilot CRDs applied: kubectl get backendtrafficpolicy -A

Next steps: NHI verification · Token cost circuit-breaking · Capability matrix