# Building Production Agent Platforms: MCP Security, Governance, and AI FinOps

> Source: <https://pub.towardsai.net/building-production-agent-platforms-mcp-security-governance-and-ai-finops-ec4d0d54456a?source=rss----98111c9905da---4>
> Published: 2026-08-04 20:01:02+00:00

Your AI agents are costing you a fortune, and you probably don’t know why.

Without proper governance, agents make unlimited tool calls, invoke expensive models unnecessarily, and bypass security controls you spent months implementing.

In Part 1, we discussed how top enterprises architect AI control planes and LLM gateways. But here’s what we didn’t tell you: **agents fundamentally change the game.**

Agents aren’t just smarter chatbots. They’re autonomous systems that make decisions, access tools, and consume resources on your behalf. Without governance, a single rogue agent can cost you $500K/month. Without observability, you won’t know it’s happening until the bill arrives.

This is Part 2 of our enterprise AI architecture series. Here’s how leading healthcare companies, financial services firms, and SaaS platforms structure agent platforms for safety, cost control, and observability.

**Missed Part 1?** Start here: [[https://medium.com/@kusumsingh209/enterprise-ai-control-plane-architecture-separating-governance-from-execution-6772a1176f53](https://medium.com/@kusumsingh209/enterprise-ai-control-plane-architecture-separating-governance-from-execution-6772a1176f53)]. Otherwise, let’s talk agents.

✅ Agent architecture and autonomous decision-making

✅ Model Context Protocol (MCP) security and server isolation

✅ Tool authorization with least-privilege policies

✅ Agent observability with distributed tracing

✅ AI FinOps: tracking, attribution, and optimization

✅ Real-world case study: HIPAA-compliant healthcare AI assistant

✅ Event bus architecture for async decoupling

✅ Multi-tenant agent isolation patterns

✅ Disaster recovery and failover strategies

✅ Platform team operating model for scale

Production agents follow a hierarchical pattern:

```
┌─────────────────────────────┐│      SUPERVISOR AGENT       │  ← Decision-maker│  • Receives user request    │  ← Determines strategy│  • Plans task breakdown     │  ← Evaluates success│  • Monitors sub-agents      │└────────────┬────────────────┘             │    ┌────────▼────────┐    │    PLANNER      │  ← Task orchestrator    │  • Breaks down  │  ← Assigns to workers    │    complex      │  ← Manages workflow    │    into steps   │    └────────┬────────┘             │    ┌────────┴────────┬────────────┬─────────────┐    │                 │            │             │┌───▼──┐         ┌───▼──┐     ┌──▼───┐    ┌────▼───┐│Worker│         │Worker│     │Worker│    │ Worker ││ API  │         │ DB   │     │ File │    │ Search │└──┬───┘         └───┬──┘     └──┬───┘    └────┬───┘   │                 │            │             │   └─────────────────┼────────────┼─────────────┘                     │             ┌───────▼────────┐             │   MCP ROUTER   │  ← Tool gateway             │  (Security,    │  ← Authorization             │   Filtering)   │  ← Audit logging             └────────────────┘                     │        ┌────────────┼────────────┐        │            │            │    ┌───▼──┐    ┌──▼───┐    ┌───▼──┐    │ Tool │    │ Tool │    │ Tool │    │  A   │    │  B   │    │  C   │    └──────┘    └──────┘    └──────┘
```

**Key Insight:** The MCP Router acts as a **tool authorization gateway**, enforcing:

Model Context Protocol (MCP) provides standardized tool integration, but security is **your responsibility**.

**Tool Authorization Levels:**

```
Level 1: BLOCKED (No access)Example: Financial system read-write (default deny)
Level 2: TENANT-SPECIFIC (Tenant A can use; Tenant B cannot)Example: Medical records API (HIPAA-compliant customers only)
Level 3: PARAMETERIZED (Can use, but with constraints)Example: SQL queries (read-only, masked results, query plan preview)
Level 4: UNRESTRICTED (Approved for all)Example: Public API queries, weather data
┌──────────────────────────────┐│   Agent Authorization Matrix │├──────────────────────────────┤_____│ Agent            │ DB  │ FS  │ API │├──────────────────┼─────┼─────┼─────┤│ Medical Summary  │ ✓   │ ✗   │ ✓   ││ Finance Report   │ ✓   │ ✓   │ ✗   ││ General QA       │ ✗   │ ✗   │ ✓   │└──────────────────┴─────┴─────┴─────┘
```

**Output Sanitization:**

Every tool response is filtered:

```
1. Check for PII (redact email addresses, phone numbers)2. Remove system internals (stack traces, config details)3. Mask sensitive fields (salary ranges, password hashes)4. Validate format (ensure expected structure)5. Size limit (prevent token explosion)6. Encoding check (prevent injection)
```

**Audit Logging:**

Every tool call is logged with:

```
{  "timestamp": "2024-01-15T10:30:00Z",  "agent_id": "medical-summary-v2",  "tenant_id": "hospital-abc",  "tool_name": "fetch_patient_records",  "parameters": {    "patient_id": "12345",    "fields": ["diagnosis", "medications"]  // Logged  },  "result": {    "status": "success",    "records_returned": 3,    "pii_fields_redacted": 2  },  "cost": {    "tool_call_cost": 0.001,    "token_impact": 250  }}
```

Single request → multiple agent calls → tool invocations → LLM calls.

**Without observability:** You can’t see where latency/cost/errors come from.

**With distributed tracing (OpenTelemetry):**

```
Request starts (trace_id=abc123)│├─ Supervisor decides strategy (span_id=001)│  ├─ Context: medical diagnosis required│  ├─ Duration: 150ms│  └─ Decision: Route to medical specialist agent│├─ Planner breaks into tasks (span_id=002)│  ├─ Task 1: Fetch patient records│  ├─ Task 2: Retrieve relevant literature│  ├─ Task 3: Generate diagnosis│  └─ Duration: 300ms│├─ Worker 1: Fetch patient records (span_id=003)│  ├─ Tool: fetch_patient_records│  ├─ Duration: 200ms│  ├─ Cost: $0.001│  └─ PII fields redacted: 5│├─ Worker 2: Retrieve literature (span_id=004)│  ├─ Tool: semantic_search (vector DB)│  ├─ Duration: 400ms│  ├─ Cost: $0.005│  └─ Results: 10 papers│├─ Worker 3: LLM call (span_id=005)│  ├─ Model: domain-specialized medical model│  ├─ Input tokens: 2,500│  ├─ Output tokens: 800│  ├─ Duration: 1,200ms│  ├─ Cost: $0.25│  └─ Quality score: 0.94 (groundedness)│└─ Response assembly (span_id=006)   ├─ Validate output   ├─ Cite sources (retrieved papers)   ├─ Add audit trail   └─ Duration: 100ms
Total Request:├─ Duration: 2,350ms├─ Cost: $0.256├─ Tool calls: 2├─ LLM calls: 1└─ Audit events: 5
```

**Metrics to Track:**

```
Per-Agent Metrics:├─ Success rate (%)├─ Average latency (ms)├─ Cost per call ($)├─ Tool invocations (count)├─ Error rate (%)└─ Hallucination rate (%)Per-Tool Metrics:├─ Call frequency├─ Success rate├─ Latency percentiles (p50, p95, p99)├─ Cost per call└─ Authorization denials (blocked calls)Per-Tenant Metrics:├─ Total cost ($)├─ Budget remaining├─ Agent performance└─ Compliance events (PII, auth failures)
```

Modern agents benefit from reasoning models:

```
Quick Response Agent (GPT-4o-mini)├─ Good for: FAQ, routing, categorization├─ Cost: $0.15/M tokens└─ Latency: 400msStandard Agent (Claude 3.5 Sonnet)├─ Good for: General-purpose, analysis├─ Cost: $3.00/M tokens└─ Latency: 800msReasoning Agent (o1 or similar)├─ Good for: Complex reasoning, coding, math├─ Cost: $15/M tokens├─ Latency: 5,000ms (slower but higher quality)└─ Use case: When accuracy > speed
```

**When to use reasoning models:**

**Evaluation Pipeline:**

```
Agent generates response    ↓LLM Judge (separate model)    ├─ Groundedness: "Is answer supported by retrieved facts?"    ├─ Relevance: "Does answer address the question?"    ├─ Safety: "Any hallucinations or harmful content?"    └─ Compliance: "Does answer respect privacy/regulations?"    ↓Scoring (0-100)    ├─ 90+: Confident, serve to user    ├─ 70-89: Moderate, flag for review    └─ <70: Low confidence, escalate to human
```

**The Scenario:** An agent makes 10 tool calls per request (normal). Each tool call costs $0.01. Your platform gets 10,000 requests/day.

```
Daily cost: 10,000 × 10 × $0.01 = $1,000/dayMonthly cost: $1,000 × 30 = $30,000/monthAnnual cost: $30,000 × 12 = $360,000/year
```

Now add in:

Your $30K/month becomes $50K-100K/month quickly.

**Without governance:** You won’t realize this until the bill arrives.

**With AI FinOps:**

```
Budget Tracking (Real-time)    ↓├─ Per-tenant spending ($X of $50K budget)├─ Per-agent cost attribution (Medical Agent: $12K, Finance: $8K)├─ Per-tool cost (DB queries: $5K, LLM calls: $15K)└─ Cost trends (↑ 15% this week, investigate why)    ↓Anomaly Detection    ├─ Agent A suddenly costs 10x normal    ├─ Tool B hit rate dropped (more calls needed)    └─ Outlier request (1 request = $500)    ↓Automatic Actions    ├─ Alert ops team    ├─ Downgrade model (Claude → GPT-4o-mini)    ├─ Disable expensive agent    └─ Escalate for approval
```

**FinOps Implementation:**

python

```
# Pseudocode: Cost tracking per agent
python
class AgentFinOps:    def track_call(self, agent_id, tenant_id, cost):        # Real-time budget check        remaining = self.get_budget(tenant_id)        if remaining - cost < 0:            self.trigger_alert("Budget exceeded")            return "BLOCKED"                # Track cost attribution        self.log_cost(agent_id, tenant_id, cost)                # Check for anomalies        avg = self.get_agent_avg_cost(agent_id)        if cost > avg * 3:            self.flag_anomaly(agent_id, cost, avg)                return "ALLOWED"
```

Production platforms decouple agent execution from downstream processing:

```
Agent Makes LLM Call    ↓┌───────────────────────────────────┐│      SYNCHRONOUS (User waits)      │├─────────────────────────────────── ┤│ 1. LLM call (500ms)                ││ 2. Tool invocation (200ms)         ││ 3. Response assembly (100ms)       ││ → Total: 800ms (user-facing)       │└──────────────┬────────────────────┘               │┌──────────────▼───────────────────┐│  EVENT BUS (Kafka/SQS/Pub-Sub)    │├───────────────────────────────────┤│ Publish events asynchronously:    ││ ├─ agent.call.completed           ││ ├─ cost.accrued                   ││ ├─ tool.called                    ││ └─ response.generated             │└──────────────┬───────────────────┘               │    ┌──────────┴──────────┬───────────┬────────────┐    │                     │           │            │┌───▼──┐           ┌─────▼──┐  ┌───▼───┐  ┌──────▼───┐│Billing│          │Audit   │  │Quality│  │Compliance││Agent  │          │Logger  │  │Scorer │  │Checker   │└───────┘          └────────┘  └───────┘  └──────────┘
These run asynchronously without blocking user response.
```

**Benefits:**

Modern platforms use feature flags to control agent behavior:

json

```
{  "medical_summary_agent": {    "enabled": true,    "version": "2.1",    "approval_required": true,    "approval_model": "claude-opus",  // LLM judge for approval    "max_tool_calls": 10,    "budget_cap": 100,  // $100/request max    "allowed_tools": ["patient_db", "medical_literature"],    "blocked_users": [],    "rollout_percentage": 75,    "fallback_agent": "general_qa"  }}
```

**Use Cases:**

Agents must respect data boundaries:

```
USER REQUEST (contains sensitive data)    ↓┌─────────────────────────────┐│  DATA CLASSIFICATION        │├─────────────────────────────┤│ Input contains:             ││ ├─ Patient name (PHI)       ││ ├─ Medical history (PHI)    ││ └─ Social security (PII)    │└──────────┬──────────────────┘           │┌──────────▼────────────────┐│  PRIVACY BOUNDARY CHECK   │├──────────────────────────┤│ Can agent process PHI?    ││ ├─ Is agent HIPAA-cert?   ││ ├─ Is tenant healthcare?  ││ └─ Is consent logged?     │└──────────┬────────────────┘           │    ┌──────▼─────────┐    │  APPROVED ✓    │  → Process request    │  BLOCKED ✗     │  → Reject + escalate to human    └────────────────┘
```

**Example Policy (HIPAA):**

```
IF request contains PHI:  THEN require:    - HIPAA-certified agent    - Healthcare tenant    - Logged consent    - Audit trail (immutable log)    - Encryption in transit + at restELSE:  ALLOW processing
```

Critical decisions require human approval:

```
Agent generates response    ↓Risk Score (LLM judge)    ├─ Low risk (score < 0.3): Serve immediately    ├─ Medium risk (0.3-0.7): Flag for review    └─ High risk (> 0.7): Require approval        ↓    ┌─────────────────────────┐    │  APPROVAL QUEUE         │    ├─────────────────────────┤    │ 1. Medical diagnosis    │    │    (Cost: $25)          │    │    Requested: Dr. Smith │    │    Status: Pending      │    │                         │    │ 2. Financial trade      │    │    (Cost: $50)          │    │    Requested: Trader B  │    │    Status: Pending      │    └─────────────────────────┘            │        ┌───┴───┐        │       │    ┌───▼─-─┐ ┌▼───-─┐    │Approve│ │Reject│    └───────┘ └─────-┘        │       │    Response  Alternative    Served    Method
```

**When to require approval:**

**Scenario:** A patient submits a request via a healthcare app.

```
Step 1: REQUEST RECEPTIONInput: "I've had a persistent cough for 3 weeks. My temp is 101F.         Should I see a doctor?"
Metadata: ├─ Tenant: MedCare Hospital├─ Patient ID: 12345├─ Region: US-East (HIPAA-compliant)└─ Timestamp: 2024-01-15 10:30:00
↓ [Route through gateway pipeline]
Step 2: AUTHENTICATION & COMPLIANCE CHECK├─ API key valid ✓├─ Tenant authorization ✓├─ HIPAA-certified infrastructure ✓├─ Data residency (US-only) ✓└─ Patient consent logged ✓
↓ [Approved for processing]
Step 3: AGENT SELECTIONAnalysis:├─ Request type: Medical diagnosis├─ Risk level: High (medical decision)├─ Approval required: Yes├─ Recommended agent: Medical Summary Agent v2.1
Selected Agent: Medical Summary Agent├─ Model: Domain-specialized medical model├─ Allowed tools: [FHIR API, Medical literature, Patient history]├─ Approval model: Claude Opus└─ Max tool calls: 10
↓ [Agent starts execution]
Step 4: AGENT EXECUTION - SUPERVISOR DECIDES STRATEGYSupervisor: "This is a symptom assessment. I need:  1. Patient medical history (chronic conditions, meds)  2. Current vital signs context  3. Differential diagnosis reasoning"
Decision: Route to medical specialist agent (not general QA)Confidence: 0.92
↓
Step 5: PLANNER BREAKS INTO TASKSTask 1: Fetch patient medical historyTask 2: Retrieve relevant medical literatureTask 3: Generate differential diagnosisTask 4: Assess risk level (needs doctor visit?)Task 5: Generate patient-friendly response
↓
Step 6: WORKER 1 - FETCH PATIENT HISTORYTool call: fetch_patient_records via FHIR API├─ Patient ID: 12345├─ Fields: ['chronic_conditions', 'medications', 'allergies']└─ Scope: Read-only (least privilege)
Response:├─ Chronic conditions: None├─ Current medications: Allergy medicine├─ Allergies: Penicillin├─ Recent visits: Flu vaccination 2 weeks ago└─ Tool cost: $0.01, Latency: 150ms
↓
Step 7: WORKER 2 - SEMANTIC SEARCH MEDICAL LITERATURETool call: semantic_search (vector DB)├─ Query: "persistent cough fever 3 weeks differential diagnosis"├─ Search depth: Medical journals + guidelines└─ Limit: Top 10 results
Results:├─ Paper 1: "Respiratory infections during flu season" (match: 0.92)├─ Paper 2: "COVID-19 symptom timeline" (match: 0.88)├─ Paper 3: "Bronchitis vs pneumonia" (match: 0.85)├─ ... 7 more results└─ Tool cost: $0.005, Latency: 300ms
↓
Step 8: WORKER 3 - LLM MEDICAL ANALYSISModel: Domain-specialized medical modelInput:├─ Patient presentation (cough, fever 101F)├─ Medical history (no chronic conditions)├─ Medications (allergy med)├─ Retrieved literature (10 papers)└─ Constraints: HIPAA, patient-friendly language
Processing:├─ Input tokens: 2,500├─ Processing time: 1,200ms├─ Output tokens: 800└─ Cost: $0.25
Output:"Based on your symptoms (persistent cough, fever for 3 weeks), the most likely causes are:
1. Viral infection (most likely, matches current flu patterns)2. Bronchitis (secondary possibility)3. Pneumonia (less likely, but monitor for difficulty breathing)
RECOMMENDATION: You should see a doctor within 24 hours. Your symptoms don't suggest an emergency, but persistent fever + cough warrants professional evaluation.
When to seek immediate care:- Difficulty breathing- Chest pain- Confusion- Blood in sputum"
Quality score (LLM judge): 0.94 (groundedness)Safety score (toxicity, hallucination): 0.97Compliance score: HIPAA compliant ✓
↓
Step 9: APPROVAL WORKFLOWRisk score: 0.68 (medium-high)Reason: Clinical decision, needs doctor oversight
Approval model (Claude Opus): Reviews response├─ Medical accuracy: ✓ Supported by literature├─ Safety: ✓ No contradictions to guidelines├─ Completeness: ✓ Addresses all symptoms└─ Appropriateness: ✓ Recommends doctor visit
Approval decision: APPROVED ✓Approval time: 400ms
↓
Step 10: RESPONSE ASSEMBLY & AUDITFinal response:├─ Clinical summary (above)├─ Cited sources (medical papers retrieved)├─ "Please consult with a healthcare provider" disclaimer├─ Audit trail (immutable log of processing)└─ Timestamp of approval
Audit event logged:{  "event_id": "evt_abc123",  "timestamp": "2024-01-15T10:30:45Z",  "patient_id": "12345",  "agent": "medical_summary_v2.1",  "tools_called": [    {"tool": "fetch_patient_records", "status": "success", "cost": 0.01},    {"tool": "semantic_search", "status": "success", "cost": 0.005},    {"tool": "llm_model", "status": "success", "tokens": 3300, "cost": 0.25}  ],  "approval_status": "approved",  "risk_score": 0.68,  "total_cost": 0.265,  "compliance_checks": ["HIPAA", "GDPR", "consent"],  "response_latency_ms": 2450}
↓
Step 11: RESPONSE TO PATIENT"Based on your symptoms, I recommend seeing a doctor within 24 hours.[Clinical summary above]
⚠️ IMPORTANT: This is not medical advice. Please consult with a healthcare professional for diagnosis and treatment."
↓
Step 12: ASYNC PROCESSING (Doesn't block user response)Event bus publishes:├─ cost.accrued ($0.265)├─ agent.call.completed├─ audit.event.logged├─ quality.score.recorded (0.94)└─ compliance.check.passed
Subscribers (process async):├─ Billing service: Update customer invoice├─ Analytics service: Track agent performance├─ Compliance service: Archive immutable audit log└─ Monitoring service: Update dashboards
FINAL METRICS:├─ Total latency: 2,450ms├─ User response time: <500ms (async doesn't block)├─ Total cost: $0.265├─ Tool calls: 2├─ LLM calls: 1 (domain-specialized)├─ Approval: Human reviewed ✓├─ Compliance: HIPAA ✓└─ Safety: No hallucinations ✓
```

✅ **Control plane** enforced HIPAA policies before request reached agent

✅ **LLM gateway** routed to domain-specialized medical model (not generic)

✅ **Tool authorization** prevented access to unauthorized databases

✅ **Observability** tracked every step (latency, cost, quality)

✅ **Approval workflow** ensured human review of medical decision

✅ **Audit logging** created HIPAA-compliant immutable record

✅ **Async processing** kept user response fast (<500ms)

✅ **Cost tracking** attributed all spending to this patient interaction

**Without this architecture?** The agent might make unlimited tool calls, use wrong models, skip approval, and generate non-compliant responses. You’d have no audit trail.

SaaS platforms must isolate tenant data:

```
Tenant A (Healthcare Provider)├─ Can access: Medical records, patient data├─ Budget: $10,000/month├─ Agents: Medical Summary, Diagnosis Assistant└─ Compliance: HIPAATenant B (Finance Company)├─ Can access: Trading data, market research├─ Budget: $50,000/month├─ Agents: Trading Bot, Risk Analyzer└─ Compliance: SOXShared Infrastructure (Isolated)├─ Separate namespaces in K8s├─ Separate Redis keys (tenant:data:...)├─ Row-level security in databases├─ Separate audit logs (immutable, tenant-specific)└─ Network policies (tenant traffic isolated)
```

**Isolation Levels:**

```
Level 1: Logical isolation (same database, row-level filtering)Level 2: Database isolation (separate databases, same cluster)Level 3: Infrastructure isolation (separate Kubernetes namespaces)Level 4: Physical isolation (separate cloud accounts / regions)
```

**For healthcare:** Recommend Level 3+ (namespace isolation, separate compute)

Production systems plan for failures:

```
PRIMARY REGION (US-EAST)├─ Active agents├─ Primary LLM gateway├─ Hot cache (Redis cluster)└─ Primary database (PostgreSQL with replication)                    │                    │ (Network partition)                    │                    X (Failure detected)FALLBACK REGION (US-WEST)├─ Standby agents (hot standby)├─ Secondary LLM gateway (ready to activate)├─ Replica cache (sync'd from primary)└─ Replica database (read-only, promoted to primary)Failover Process:1. Health check fails on primary (3x failures, 5 sec timeout)2. Circuit breaker opens3. DNS updates point to US-WEST4. Replica database promoted to primary5. Standby agents become active6. Traffic redirects to secondary gateway→ Total failover time: <30 secondsRTO (Recovery Time Objective): 30 secondsRPO (Recovery Point Objective): 5 seconds
```

Enterprise platforms need comprehensive observability:

```
┌─────────────────────────────────┐│  APPLICATION LAYER METRICS      ││  ├─ Agent success rate          ││  ├─ End-to-end latency(p50,p95,p99)│  ├─ Cost per request            ││  └─ Approval wait time          │└──────────────┬──────────────────┘               │┌──────────────▼──────────────────┐│  GATEWAY LAYER METRICS          ││  ├─ Cache hit rate (%)          ││  ├─ Router decision time        ││  ├─ Fallback frequency          ││  └─ Provider latency            │└──────────────┬──────────────────┘               │┌──────────────▼──────────────────┐│  PROVIDER METRICS               ││  ├─ Availability (uptime %)     ││  ├─ Error rate per provider     ││  ├─ Latency percentiles         ││  └─ Cost per provider           │└──────────────┬──────────────────┘               │        ┌──────▼────────┐        │  ALERTS       │        ├───────────────┤        │ P95 > 5s?     │        │ Cost > 10%?   │        │ Error > 1%?   │        │ Cache < 20%?  │        └───────────────┘
```

**Dashboard Examples:**

Dashboard 1: Financial (CFO/Finance)

Dashboard 2: Operations (DevOps/SRE)

Dashboard 3: Security (Security/Compliance)

For scale, you need a dedicated platform team:

```
┌─────────────────────────────┐│  PLATFORM TEAM STRUCTURE    │├─────────────────────────────┤│                             ││  Platform Lead              ││  └─ Owns platform roadmap   ││                             ││  Infrastructure (2-3 eng)   ││  └─ K8s, gateway, DR        ││                             ││  Governance (1-2 eng)       ││  └─ Policies, registries    ││                             ││  Observability (1-2 eng)    ││  └─ Metrics, dashboards     ││                             ││  Security (1 eng)           ││  └─ MCP security, compliance││                             ││  FinOps (0.5 eng)           ││  └─ Cost tracking, billing  ││                             ││  Developer Advocate (1 eng) ││  └─ Agent framework docs    ││                             │└─────────────────────────────┘
```

**RACI Matrix:**

TaskPlatformApp TeamSecurityOpsDeploy new agent-RCAGateway updateA-CRSecurity policyRCA-Cost optimizationAC-RIncident responseCCCA

Agents fundamentally change the economics and governance of AI systems:

**Without governance:**

**With governance:**

**Agents aren’t just “smarter LLM calls.” They’re autonomous systems that require:**

✅ **Supervisor/Planner pattern** (hierarchical decision-making)

✅ **MCP Router** (tool authorization gateway)

✅ **Approval workflows** (human-in-the-loop for high-risk decisions)

✅ **Distributed tracing** (visibility into multi-step execution)

✅ **AI FinOps** (track, attribute, and optimize costs)

✅ **Compliance boundaries** (respect data privacy)

✅ **Disaster recovery** (failover when primary fails)

✅ **Platform governance** (centralized policies)

You’ve now read the complete enterprise AI architecture series:

**Next steps:**

**Questions?** Drop a comment. I read every one and respond to implementation questions.

**Sharing?** If this helped your team, share it with fellow architects and engineers.

**Building this?** Document your journey. The enterprise AI ops space needs more real-world patterns.

**Published:** **Part:** 2 of 2 **Previous:** Enterprise AI Control Plane Architecture (Part 1) **Series Complete:** Thanks for reading the full enterprise AI architecture guide!

If you implement this architecture, document your decisions:

```
TITLE: Implement Weighted Scoring RouterCONTEXT: Need intelligent model selectionDECISION: Use capability (30%) + cost (10%) + latency (15%) +           compliance (20%) + availability (10%) + quality (15%)RATIONALE: Balances multiple concerns, tunable weights per use caseTRADEOFFS: Slightly more complex than simple rules
TITLE: Enforce HIPAA Boundary for Medical AgentsCONTEXT: Healthcare tenant requires HIPAA complianceDECISION: Agents can only access HIPAA-certified tools,          responses require approval before deliveryRATIONALE: Prevents unauthorized data access, ensures complianceTRADEOFFS: Slower response time (approval workflow)
TITLE: Track Costs at Tool-Call GranularityCONTEXT: Need to attribute costs to specific agents/tenantsDECISION: Log every tool call + LLM invocation with cost metadataRATIONALE: Enables accurate chargeback, anomaly detectionTRADEOFFS: Storage + query overhead (manageable with aggregation)
```

Enterprise AI isn’t just about deploying smart systems. It’s about building smart systems that:

This series gave you the architecture patterns. The implementation is yours.

**Good luck building.** 🚀

[Building Production Agent Platforms: MCP Security, Governance, and AI FinOps](https://pub.towardsai.net/building-production-agent-platforms-mcp-security-governance-and-ai-finops-ec4d0d54456a) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.