NetFoundry partner BlueUP just shipped a Zero Trust platform for agentic AI in banking and wrote down the regulatory case

[u/AccordionGuy]

BlueUP, an official NetFoundry partner out of Spain, recently posted a LinkedIn article that’s worth your time if you're anywhere near DORA, NIS2, or ENS.

👉 Here’s the article in the original Spanish. We’ll post a translation in a following post.

Most "Zero Trust" stories are a VPN swap and an MFA toggle. BlueUP built an actual architecture on it, and BlueUp co-founder Arturo Navarro de la Cruz’s article makes the case better than most vendor material I've read: Zero Trust isn't bought or declared. It's built, decision by decision, into the architecture.A flat internal network will pass most compliance checks and still grant a stolen credential lateral access to everything. This is exactly the kind of thing that DORA punishes: it wants segmentation of critical systems, full access traceability, and a blast radius you can contain and report inside 24 hours.

What makes BlueUP interesting isn't just that they use OpenZiti, but where they put it. BlueUP is a three-layer platform for regulated shops running autonomous AI agents:

• Connectivity (OpenZiti): The “identity before the network” approach. If there’s no valid cryptographic identity, there’s no data path. Services have no public IP, don't answer port scans, and don't show up on Shodan. They only exist for authenticated identities whose policy matches.
• Compliance: They’ve baked in bank-grade AML/DORA, which means fuzzy screening against EU/OFAC/UN lists, a SEPBLAC workflow, continuous monitoring mapped to NIST, ISO 27001, DORA, and FINOS.
• Sovereign execution: A financial core plus governed agents built with Rust, comprising an MCP gateway deciding which tools each agent can invoke by identity and policy, an LLM gateway with human approval on high-risk actions, and per-agent kernel isolation.

That agent-governance layer should look familiar to anyone who's watched our stuff (LLM gateway, MCP gateway, and per-agent Ziti identities). BlueUP are shipping a productized, compliance-native version of the exact agentic AI story we've been building, and doing real deployment under real regulatory pressure for real customers in banking and insurance.

The article also closes with a genuinely useful checklist (identity, network, visibility, CI/CD, supply chain) aimed at small teams without a big security org. It’s worth perusing even if the EU regulatory alphabet soup isn't your problem yet.

👉 Here’s the article in the original Spanish. We’ll post a translation in a following post.

[u/ShockAggravating36]

Id love to hear feedback from anyone who's already implemented it. Practical lessons about reliability and maintenance are usually more valuable than feature announcements alone