Routing requests to compliant infrastructure covers where the model runs. With ITAR there is still the question of who inside the company gets to see the answer. Export rules apply to foreign persons, including employees working in the US (the deemed export case). So if an agent can pull controlled technical data through a tool call or a retrieval step, a non-US-person engineer who asks the right question gets it back, whichever endpoint served the request.
Do you pass user attributes like US-person status or program access through the gateway, so retrieval and tool calls can be filtered per request? Or is that expected to live in each customer's own systems?
I work at Permit, which builds authorization tooling, so this is the part I always end up asking about.