Export Control Proxy Team
Most organizations enforce export-control access the same way: a policy document, a training deck, and a lot of trust. It’s a reasonable starting point, and it fails in a specific, predictable way. Nobody finds out it failed until an audit or an incident asks “who had access to this, and from where, on this date?” and the honest answer is “we don’t know.”
The fix isn’t more training. It’s moving the enforcement point from people’s memory into the request path itself, in front of the systems that already matter: source control, code quality tooling, artifact storage, CI. A request either matches policy or it doesn’t, and either way, that decision gets written down.
That’s the shape of what we built: a reverse proxy that sits inline in front of each protected system, resolves who’s asking and where they currently are, evaluates a denylist rules engine, and logs the outcome, whether that’s allow, deny, fail-open, or fail-closed, every time. Not just on denials. The audit trail is the point, not an afterthought.
