WSO2 has made its AI Workspace available as a fully self-managed deployment, allowing organizations to run the platform’s AI governance control plane inside their own infrastructure. The company announced the change on August 25, 2026, saying the new deployment model is designed for organizations that need greater control over where their AI management infrastructure operates.
AI Workspace is the control plane for WSO2’s AI Platform, while the company’s AI Gateway serves as the runtime layer that handles AI traffic and enforces policies. Until now, customers could deploy the AI Gateway in their own environments while the control plane was operated by WSO2 as a software-as-a-service service. The new release allows both layers to be managed by the customer.
According to WSO2’s announcement, organizations can deploy the self-managed AI Workspace on premises, in a sovereign cloud, with a hyperscale cloud provider or in a fully air-gapped environment. WSO2 says the deployment does not require a vendor-hosted component and can operate without an outbound connection to WSO2 in an air-gapped setup.
The company launched AI Workspace in March 2026 with cloud and hybrid deployment options. In the hybrid model, WSO2 operated the control plane while customers could run AI Gateway instances in their own environments. The latest release adds the fully self-managed option, completing the three deployment models offered by WSO2: cloud, hybrid and self-managed.
WSO2 has kept AI Workspace separate from its traditional API control plane. The company says AI systems have different operational requirements, including frequent changes to models, prompts and routing, as well as the need to track token consumption and AI-related costs. It also points to AI-specific controls such as prompt-injection detection, personally identifiable information protection, content safety, JSON-schema validation and filtering of Model Context Protocol, or MCP, tools.
The AI Workspace documentation describes the platform as a central management layer for AI resources, including AI Gateway runtimes, large language model providers, application-specific LLM proxies, MCP proxies, GenAI applications, credentials and AI policies. Supported providers listed by WSO2 include OpenAI, Anthropic, Azure OpenAI, Google Gemini and Mistral AI, while its documentation also includes AWS Bedrock among supported provider capabilities.
Cost control is another part of the platform. WSO2 documents token-based rate limiting and LLM cost-based rate limiting, with cost calculations based on factors such as model, token usage, context-window tier and service tier. The documentation lists OpenAI, Anthropic, AWS Bedrock, Google Gemini and Mistral among the providers covered by these cost calculations. Organizations can also configure monetary spending limits over defined periods and block additional requests after a budget has been exhausted.
The platform also extends governance to MCP-based systems. Organizations can create managed MCP proxies and apply controls for authentication, authorization, access control, rewriting, rate limiting, logging and other policy functions. WSO2 says internal resources can also be exposed as MCP servers while remaining subject to the platform’s policy framework.
The release introduces several other changes. WSO2 has added gateway-to-workspace synchronization, allowing artifacts created directly on an AI Gateway to be synchronized back to AI Workspace. The company says these artifacts can include LLM provider templates, LLM providers, LLM proxies and MCP proxies, with synchronized gateway configurations treated as read-only in the Workspace for the components that determine how the gateway serves traffic.
Organizations can also create custom LLM provider templates for services that are not covered by WSO2’s built-in templates. The feature can be used for self-hosted models, internal inference services and regional or otherwise unsupported AI providers. Global policies can also be applied across providers or proxies instead of being configured only at the individual resource level.
WSO2 has documented several deployment methods for the self-managed Workspace. A Docker Compose quick-start deployment is available for evaluation, while the company’s production deployment documentation covers Docker Compose on virtual machines and Helm-based deployment on Kubernetes.
The production documentation specifies Kubernetes 1.24 or later with Helm 3 for Kubernetes deployments. AI Workspace’s Platform API stores artifacts such as gateways, LLM providers, proxies, applications and subscriptions. WSO2 supports SQLite, PostgreSQL and Microsoft SQL Server, with SQLite intended for simpler deployments and server-based databases recommended for production environments that use multiple Platform API replicas.
WSO2 also documents high-availability configurations. Multiple Platform API instances require a shared database, while the database itself needs to be configured for high availability if it is not to become a single point of failure. For production authentication, the company recommends connecting AI Workspace to an identity provider using OpenID Connect. Its documentation cites Asgardeo and Microsoft Entra ID as examples of compatible providers.
The self-managed release also supports a CI/CD workflow in which AI Workspace artifacts can be stored as version-controlled project files and deployed using WSO2’s ap command-line interface. The documented workflow supports LLM providers, application LLM proxies and MCP proxies, allowing teams to validate configurations, commit them to source control and promote changes between environments.
WSO2 is positioning the self-managed deployment around organizations that require tighter control over AI infrastructure, including regulated businesses, government organizations and environments with strict requirements for data and infrastructure sovereignty. In its announcement, the company referenced regulatory and procurement developments involving the EU AI Act, DORA, NIS2 and eIDAS 2.0, as well as government interest in open-source-first procurement.
The company describes the release as a way to remove the remaining vendor dependency from AI governance infrastructure. With the control plane and AI Gateway both deployed within the customer’s environment, organizations can manage AI providers, routing, policies, guardrails, access controls and cost controls without relying on a separately hosted WSO2 control plane.
WSO2 says AI Workspace is generally available as part of its API Platform. The company has also published the WSO2 API Platform source repository on GitHub, while its documentation provides installation, authentication, database, production and CI/CD guidance for AI Workspace.
While WSO2 describes the platform as having an open-source foundation, its subscription model still applies to production use and enterprise support. The self-managed deployment therefore changes where customers can operate the platform, but it should not be interpreted as meaning that all commercial WSO2 services are provided at no cost.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
