Make the gateway the only sanctioned inference path and disable any workflow that lets users authenticate directly to the model provider for enterprise use. Then verify that every desktop session produces request logs, attributed billing, and model-policy enforcement in the same control plane as other non-human access paths.
Make the Gateway the Enforced Enterprise Inference Path
The core control is architectural, not cosmetic: desktop AI clients must not be allowed to reach model providers on their own for enterprise use. Treat the gateway as the only sanctioned path, and remove any direct-auth workflow that lets a user or app establish a separate relationship with the provider outside enterprise governance.
That matters because the bypass creates a parallel control plane. Once sessions can go direct, teams lose consistent policy enforcement, usage attribution, and the ability to prove which prompt, model, and tenant context were actually in play.
A practical way to think about the target state is that the gateway becomes the place where access is granted, constrained, logged, and billed, while the desktop client is only a consumer of that governed path. If a client can still self-authenticate to the provider, the enterprise has not actually centralised control.
What Must Be True of Every Desktop Session
Stopping bypass is only complete when every desktop session is forced through the same operational evidence chain as other non-human access paths. That means the team can show request logs, attributed billing, and model-policy enforcement from one control plane rather than reconstructing activity from provider-side fragments.
Shadow AI and AI Agent Discovery Guide is useful here because direct-provider use often hides as unmanaged AI activity, which is exactly the condition teams need to inventory before they can govern it.
When the gateway owns the path, it can also apply the enterprise rules that matter most in practice: model allowlists, prompt and response controls, quota enforcement, and consistent metadata capture. Without that, the organisation may know a desktop app made a call, but not whether it did so under approved policy or under a user-created direct connection.
How to Detect and Remove the Bypass Path
Teams should look for any workflow that lets the desktop client store its own provider credentials, mint its own tokens, or exchange user login state for a model-provider session outside the gateway. Those are the usual bypass mechanisms, because they let the client sidestep enterprise routing while still appearing legitimate to the upstream service.
LLM Provider API Key Security and LLMjacking Guide supports the same control objective from the credential angle: if provider keys are exposed to endpoints or desktop workflows, the gateway can no longer guarantee that all consumption is mediated and attributable.
Remote Access Identity Guide is also relevant as a control pattern, because the same mistake appears when teams leave an alternate direct access route open after introducing a managed entry point. The fix is to retire the alternate route, not merely monitor it.
In practice, that means blocking direct provider domains where possible, removing client-side secrets, and checking that the application cannot fall back to an unmanaged endpoint when the gateway is unavailable. If fail-open behavior exists, it should be treated as a design defect, not an acceptable backup.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Centralise sanctioned access paths and remove unmanaged direct-provider accounts. |
| Recommendation — Eliminate direct desktop-provider accounts and require all enterprise access through the gateway. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | The answer depends on request logging and attribution from one control plane. |
| IA-5 — Authenticator Management | Direct provider bypass is often enabled by client-held secrets or tokens. | |
| AC-6 — Least Privilege | Gateway-only access reduces direct entitlement to upstream model services. | |
| Recommendation — Log every gateway-mediated desktop inference request as a required audit event. Prevent desktop clients from using unmanaged provider secrets or long-lived tokens. Restrict model-provider access so desktop clients cannot authenticate directly. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | The subject is governing authenticated access to model providers through one path. |
| Recommendation — Enforce one authenticated access path and block direct desktop-to-provider access. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Bypass paths commonly rely on exposed provider keys or client secrets. |
| Recommendation — Keep provider credentials out of desktop clients and route all use through the gateway. | ||
Practitioner Guidance
What to verify: Confirm that every desktop client request is server-side mediated, that the gateway injects the policy context, and that the provider never sees enterprise traffic from a client-owned credential path. If a desktop session can authenticate without the gateway, the control has failed.
What to prioritise: Start with the highest-value enterprise desktop workflows and the users most likely to have direct-provider access already, because those are the paths most likely to bypass governance while still generating meaningful consumption.
What good looks like: A desktop AI session cannot function unless it traverses the gateway, inherits the enterprise policy set, and produces a single audit trail that security, finance, and operations can reconcile without manual stitching.
Practitioner takeaway: The real control is not “visibility into desktop AI,” it is eliminating every alternative route so the gateway becomes the only place where access, policy, and cost are actually enforceable.
Related resources from NHI Mgmt Group
- How should security teams stop employees from bypassing governed AI access?
- How should security teams stop AI agents from bypassing MCP controls?
- How should security teams stop AI orchestrated intrusion chains from bypassing IAM controls?
- What should teams do when AI clients outside the gateway are in use?