01
The inference never sees the data
The model and skill IP stay vendor-side; only a projection returns. This is a stronger claim than "we encrypt the tunnel" — the data was never in the request the model read.
The link is a membrane — not a tunnel.
Every "secure connectivity" vendor moves your data to the software. Legation moves the software's hands to your data, and lets only a governed projection back out. That inversion is the whole product — and the reason a customer's security team can say yes.
Operator → embassy → your MCP and agent. One hop each, all in your VPC — only a projection comes back.
01 / Tunnel vs. membrane
A tunnel carries data out. A membrane keeps it in.
The distinction is not cosmetic. A tunnel — VPN, reverse proxy, API gateway — is defined by what it lets through: your request goes in one side, the raw result comes back the other. Legation is defined by what it refuses to let through.
A tunnel
Moves the data to the software
- Request in, raw result out
- The model and the vendor see whatever comes back
- Security rests on "we encrypt the pipe"
- Interchangeable with a dozen gateways
The membrane
Moves the software's hands to the data
- A sealed, mandated call goes in
- Execution happens next to the data, inside the customer VPC
- Only a redacted projection comes back — never the raw result
- The inference never sees the data, so it can't leak it
The one-line testIf raw customer data can travel back to the vendor, it's a tunnel. In Legation, it structurally cannot — the software that would read the data runs on the customer's side of the membrane.
02 / The topology
The operator addresses the embassy — never the workloads.
This is the single picture that answers the question everyone asks. The workloads — an agent, an MCP server — live entirely on the customer's side of the membrane. The embassy is the only actor that talks to them, and it does so in-VPC. The operator holds exactly one relationship: app → Legation → embassy.
Operator side
Vendor Appreasoning + skill IP — plans off projections, never raw data
holds one relationship →
▼ intent → sealed command
Legationhub + governed link
▲ governed projection
Customer VPC
Embassythe only actor that touches the workloads · runs the loop in-VPC
embassy → workloads (in-VPC only)
A2A Agentin-VPC
MCP Serversecure · in-VPC
No operator → workload edge exists. There is no wire from the vendor app to the A2A agent or the MCP server. Those edges live only inside the customer VPC. Ask for a direct channel to them and you are asking for a tunnel — a different, weaker product, and not Legation.
In plain words — what to tell a customer
"The operator never talks to your MCP server or your agent directly — that's the whole point. The operator makes one call, to the embassy. The embassy is the only thing that touches the MCP server and the agent, and it does that inside your VPC. What comes back to the operator is a governed projection — a result, never your raw data."
"So how does my tool call reach the MCP?"You hand the embassy an intent — a specific tool call or an objective for the agent. The embassy runs it in-VPC and returns only the projection. There's no wire from the operator to the MCP or the agent; only the embassy has that.
"Why can't the operator connect to the MCP directly?"By design, it can't. A direct connection would mean your raw data flows back to the operator. The embassy exists precisely so that never happens — the operator gets the answer, your data stays home.
03 / What actually crosses
The boundary is asymmetric by design.
Two different things move in two different directions, and neither is "the data." Down: an instruction. Up: a governed projection of what happened.
Down — into the customer VPC
Vendor call→Sealed & mandated command→Embassy executes locally
The vendor sends a tool call bound to identity, a signed treaty, and a per-task mandate. The model and the vendor's skill IP stay on the vendor side — only the hands cross.
Up — back to the vendor
Raw result stays local→Redaction / projection→Structure-only projection
The Embassy governs the output before anything returns: a decision, a verdict, a redacted structure, an evidence reference. The raw rows, files, and credentials never leave the customer boundary.
Proven, not assertedThe data-flow inversion is exercised in the evaluation harness with
0 fetch_body — the workload completes its task without the raw payload ever crossing.04 / Three guarantees
Three things a tunnel can never promise.
Mutual auth and encryption are the floor — every gateway has them. These three are what the membrane adds, and what the customer's security team can independently verify.
02
Your IP crosses sealed
The vendor's agents and MCP servers land inside the customer VPC as a signed, sealed bag. It runs there; it cannot be opened, copied, or extracted — not by the customer, not by an insider.
03
The agent can't be hijacked mid-task
Every task commits to a signed plan before it processes any untrusted input. A prompt injection that arrives later tries to act outside that plan and is refused — commit-then-act, enforced on the customer's own soil.
05 / The floor
Everything you'd expect — carried quietly underneath.
The membrane is also a competent secure transport. These are table stakes, not the pitch: they run automatically so the three guarantees above can stand on top of them.
- Mutual authentication (mTLS)
- Workload identity & proof of possession
- Routing & regional failover
- Authorization against signed policy
- Encryption in transit, CNSA 2.0-aligned
- Tamper-evident audit & evidence
- Request / response correlation
- Anti-replay & fail-closed behavior
06 / The developer's view
Your application makes a normal call. The transport is invisible.
Developers should not think about links, routes, or connections. They call an operation; Legation resolves which customer, which Embassy, which route, which identity, and which secure connection — and returns a governed projection.
// The vendor writes this:
let projection = legation.invoke(embassy, task).await?;
// Legation does this, invisibly:
// seal + mandate the call -> route over the outbound link
// admit & enforce in-VPC -> execute next to the data
// redact + project -> return structure-only result
// The raw data never entered the call the model can read.No SDK is required to adopt Legation.The same operation is a plain authenticated call to the hub —
POST /api/task with a scoped bearer token. The SDK is ergonomic sugar that makes the membrane invisible; it is never a gate on adoption.07 / What it is not
Never a pass-through.
"Pass-through" is the one word that describes the opposite of Legation. A pass-through returns the raw result to the caller. The membrane runs the caller's software next to the data and returns only what policy permits. If a design ever lets raw data back to the vendor, it has stopped being Legation.