Introduction
At the Architects Community on December 10, 2026, one question took center stage: how do you combine governance and security with innovation and speed in an AI‑driven landscape? CoolProfs shared its vision for a hybrid AI architecture—an approach that unites control and flexibility. We showed how this strategy works in practice. The session offered not only insights into architectural choices, but also practical guidance for implementing AI responsibly and at scale within complex organizations.
Why This Approach?
In a world where AI increasingly impacts business processes, a single centralized solution is often not scalable. That’s why we opt for a hybrid architecture that safeguards governance and security without sacrificing innovation and speed. In this blog, you’ll read how we do that and the lessons we’ve learned.
Why a Centralized Solution Isn’t Scalable
Many organizations start with a central AI solution. It feels safe: one platform, one set of rules, one team that manages everything. But in practice this rarely scales.
Enterprise landscapes are diverse: multiple platforms, different business domains, and varied development cultures. A central solution can slow down innovation and quickly becomes a bottleneck.
Imagine you use OutSystems for low‑code, SAP for ERP, and ServiceNow for ITSM. If you impose a single central AI platform, every team must use the same tools and processes. That rarely works: domain‑specific needs collide with uniform frameworks.
Our Architects Community confirmed this: a centralized start is fine for gaining experience, but if you want broad AI adoption, you need a hybrid model.
The Challenge of Hybrid
Hybrid sounds ideal: central guardrails, decentralized freedom. Yet it raises questions:
- How do you ensure compliance if teams build their own agents?
- How do you prevent governance from blocking innovation?
- How do you allow room for development without losing control?
At CoolProfs, we addressed this challenge by distributing our AI policy intelligently across two layers:
- Central Layer (LLM Foundation) — where risks and governance belong.
- Business Layer (AI Agents) — where domain‑specific value is created, within guardrails.
Why This Two‑Layer Approach Works
- The central layer manages everything that introduces horizontal risk: model management, security, observability, risk alerts.
- The business layer gives teams the freedom to build agents, while enforcing compliance through tooling and processes.
How to Apply AI Policy to Both Layers
1. Central Layer — LLM Foundation
Responsibilities of the central team:
- Model Management & Catalog: approved models, metadata, risk labels.
- Guardrails & Risk Alerts: PII masking, prompt filters, toxic content checks, rate limiting.
- Monitoring & Logging: latency, costs, audit trails, anomaly detection.
- Quality Gate: blocks non‑compliant updates in pipelines.
- Advisory Role: supports model selection, TCO calculations, and onboarding of new model versions.
The central layer manages the generic risks that affect multiple teams. Uniform management = control without stifling innovation.
2. Business Layer — AI Agents
This is where value emerges: domain teams build agents with prompts and data. Compliance still applies here—by design.
- AI Registry: every agent is automatically registered (CoolProfs offers a tool for this: CoolAIRegistry), including purpose, system prompt, and data use.
- Policy Checks: the system prompt is validated against AI policy.
- CI/CD Gate: at every release the tool validates compliance automatically. Not compliant? The pipeline stops.
Important: the classifications we check (such as Human‑in‑the‑Loop, IP Protection, Privacy & Security) aren’t hard‑coded defaults but are derived from your organization’s AI policy.
For example: a bank adds stricter logging and privacy rules; the tool reads the policy and tags them automatically. A retailer sees more emphasis on labeling and transparency.
Collaboration Between the Layers
The central team doesn’t just deliver governance, it also provides hands‑on support:
- Templates for system prompts.
- Connector whitelists.
- Advice on model choice and costs (TCO).
- Support for adopting new model versions.
Enterprise Example
In an organization with OutSystems, SAP, and ServiceNow, all domains can build agents within the same guardrails.
- An OutSystems AI Workbench agent that accelerates internal processes.
- An SAP agent that supports financial reporting.
- A ServiceNow agent that classifies incidents.
All of them operate within the same governance and compliance checks—without being tied to a single platform.
Why CoolAIRegistry on OutSystems?
We built this tool because there was no standard solution that could dynamically link AI governance to CI/CD and agent registration. OutSystems gives us the speed and flexibility to build a governance app that integrates easily with existing processes and adapts to each organization’s AI policy. Manual checks are slow and error‑prone; with the tool we automate compliance and make AI adoption scalable and safe.
CoolAIRegistry is an OutSystems app that acts as both AI registry and quality control.
- Automatic registration of agents.
- Analysis of AI policy and tagging of relevant rules.
- CI/CD integration: blocks non‑compliant agents before they reach production.
This way, compliance becomes a building block of innovation instead of a brake. Without this system, governance would slow things down, pilots would stall, and shadow IT would likely emerge.
Why This Is a Scalable Model
This model is designed for organizations with multiple platforms and teams. By centralizing governance and automating compliance checks, you prevent a single team from becoming a bottleneck. Multiple teams can experiment in parallel without depending on a single approval process.
Results:
- Rapid innovation within domains.
- Uniform policy adherence.
- Reduced risk of uncontrolled AI usage.
Conclusion
The hybrid model combines control and speed. The central team ensures governance and risk management, while business domains can innovate safely. By interpreting policy dynamically and automating compliance, we make AI adoption scalable at enterprise level—without bottlenecks, without shadow IT, and with room for creativity.
Jeroen Bezemer, CTO, CoolProfs