Your gateway, inside your perimeter.

Everything above, plus the deployment model, contract and support posture procurement needs before it signs.

SSO, scoped roles and an audit log that records configuration changes, not just requests.
Private or on-premise deployment for traffic that cannot leave your own infrastructure.
SLA commitments and dedicated support, with framework packs already wired to runtime controls.

Inside your perimeter.

Some traffic cannot leave your own infrastructure, and no amount of certification changes that. Private and on-premise deployment puts the gateway where the data already is.

What procurement asks for.

SSO and scoped roles. An audit log covering configuration, not just requests. Framework packs already wired to runtime controls. SLA commitments and a named contact rather than a support queue.