AI gateways for agentic AI: identity, policy and budget control

At a glance

What this is: This is an analysis of AI gateways for agentic AI and the finding that identity, policy, tracing and token budgets have to be enforced at the gateway layer, not left to individual agents or downstream tools.

Why it matters: It matters because IAM, NHI and AI governance teams need a single control point for agent identity, tool access, auditability and spend before multi-agent workflows outgrow conventional gateways.

By the numbers:

• According to Gartner, over 40% of agentic AI projects will be canceled by the end of 2027 because of cost, unclear value and weak risk controls.
• A July 2026 study found about 92% of 414 tested public MCP servers had no OAuth.
• Anthropic measured multi-agent systems at about 15 times the tokens of a chat.

Context

AI gateways for agentic AI sit between agents and the models, tools, MCP servers and other agents they call. The governance gap is simple: once work is distributed across chained decisions, traditional request-by-request controls stop telling you which identity is acting, what it is allowed to do, or how far a workflow has already propagated.

That gap is structural rather than cosmetic. Agentic systems can mix identity, delegation, logging and spend in one execution path, which means policy has to follow the workflow rather than the endpoint. Agentic AI identity is the right frame here because the core problem is not just routing traffic, but governing who can act, on whose behalf, and under what limits.

The article also shows why gateway design now overlaps with NHI governance. When each agent carries credentials, the access model starts looking like a machine identity problem, but with dynamic decisions layered on top. That is why the control point has to understand both identity and runtime behaviour.

Key questions

Q: What breaks when credentials are reused across agentic AI workflows?

A: Reusable credentials break the assumption that access can be tied to one task, one context, or one owner. They become portable across sessions and can be exposed in chat history, scripts, or configuration files. That makes attribution weak and revocation slower than the risk warrants.

Q: Why do agentic AI projects need a gateway rather than only API management?

A: Agentic workflows need enforcement across model calls, tool calls and inter-agent delegation, not just request routing. API management can expose services, but it does not usually correlate the whole workflow, scan content before action or cap token spend per run. A gateway becomes necessary when governance must follow the chain of decisions, not just the endpoint.

Q: How do you know whether a managed AI gateway is actually reducing risk?

A: Measure whether access reviews, token scoping, logging, and certificate rotation are more consistent after the move. If governance still depends on manual exceptions, the platform has only changed where the complexity lives.

Q: What happens when an agentic workflow exceeds its intended budget or scope?

A: The workflow can keep calling models and tools long after the original task should have ended, which increases cost, widens exposure and makes review harder. In practice, the failure is not only financial. It is a governance failure where the system has no hard boundary for continuation, escalation or handoff to a human reviewer.

Technical breakdown

Why traditional API gateways fail for agentic workflows

A conventional API gateway treats each request as an isolated transaction. Agentic AI breaks that assumption because a single user task can fan out into model calls, tool calls, inter-agent handoffs and repeated retries before any visible outcome appears. The gateway therefore has to correlate identity, sequence and intent across the whole chain, not just authenticate an inbound request. This is where policy, tracing and budgets become inseparable: once the planner agent starts chaining actions, the control plane needs to know which steps belong to the same workflow and which actor authorised them. See the Agentic AI Security Guide. See the Agentic AI Security Guide.

Practical implication: Treat workflow correlation as a control requirement, not a logging enhancement.

How per-agent identity and delegated access should work

The article’s central identity model is per-agent, not per-platform. Each agent should authenticate with its own identity, then receive scoped permissions tied to the user and the task, rather than sharing a master credential that flattens attribution. That matters because shared keys make every agent look the same in logs and widen the blast radius when one agent is compromised or misrouted. The same logic applies to MCP and A2A traffic: the resource being accessed should validate audience, scope and delegated authority, instead of trusting that upstream components got it right. See the Agentic AI Identity Guide.

Practical implication: Issue distinct identities to agents and bind every tool call to scoped delegated authority.

Why budgets and traces are governance controls, not telemetry

In agentic systems, trace data is the only practical way to reconstruct a decision path after the fact, and token budgets are the only way to stop runaway loops before they become an incident or an unplanned bill. The article makes a useful distinction between visibility and enforcement: logs show what happened, but per-call, per-run and per-agent limits decide whether the chain continues. That is especially important when agents can call models and tools repeatedly without human review. Observability without enforcement creates better evidence of failure, not prevention. See the Agentic AI Security Guide.

Practical implication: Set hard limits at the workflow layer and use traces to explain denied or truncated runs.

Threat narrative

Attacker objective: The objective is to get an agentic workflow to consume data, tools and budget beyond its intended scope while remaining difficult to attribute, interrupt or audit.

1. A legitimate user request enters an agentic workflow and is delegated to one or more agents with their own credentials and tool access.
2. The workflow expands into chained model, tool and inter-agent calls, and scope drift emerges when the chain starts using more access, tokens or tools than the original task justified.
3. If policy, trace propagation and per-agent limits are missing, the chain continues without effective human review, allowing tool misuse, prompt injection or cascading failures to compound impact.

Breaches seen in the wild

• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI gateways have become the enforcement point where agent identity, tool policy, traceability and spend control converge. That is a different governance problem from classic API management, because the workflow itself is now the unit of control. If the gateway does not sit on the only path an agent can use, policy becomes advisory rather than enforceable, and the organisation loses visibility into who acted, through which tool, and at what cost.

Shared credentials are the wrong abstraction for agentic systems. The article shows why one agent should not inherit every other agent’s access or appear as a generic caller in logs. In practice, that collapses attribution, weakens delegated authority and turns a compromised agent into a broad trust failure. The right mental model is per-agent identity with scoped delegation, not one shared machine account wearing multiple masks.

Runtime control assumptions must change when workflows can self-extend. Access review processes assume access is stable long enough to be certified, but agentic chains can acquire, use and discard privilege inside a single execution path. That means the governance question is no longer only who was approved, but whether the approval model can see and govern runtime scope drift at all. Agentic AI identity maturity is the useful lens for measuring that gap.

Token spend is an identity signal as much as a finance signal. When a workflow loops or fans out unexpectedly, budget overrun often reflects a control failure in delegation, orchestration or policy enforcement. The implication is that spend telemetry should be treated as evidence of governance quality, not just cloud consumption. Teams that ignore spend in identity oversight miss one of the clearest signs that agent behaviour has moved outside design intent.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Policy has to move from the service boundary to the workflow boundary. Agentic systems do not fail only at the moment of authentication. They fail when delegated actions compound across model calls, tool calls and inter-agent hops faster than human governance can keep pace. The practical shift is to treat each workflow as a governed execution path, not as a series of unrelated requests.

Runtime governance will increasingly separate mature agent programmes from experimental ones. Only 13% of organisations feel extremely prepared for the reality of agentic AI, according to the 2026 Infrastructure Identity Survey, which suggests most teams are still trying to control autonomous behaviour with controls built for static access. The next step is to design for issuance-time governance, not review-time reassurance.

Agentic AI identity maturity will become a measurable programme outcome. Organisations that can prove per-agent identity, scoped delegation, trace propagation and budget enforcement will be able to scale more safely than those relying on shared keys and post hoc reviews. The question is no longer whether gateway controls are useful, but whether the identity programme can enforce them consistently across the full chain.

For practitioners

• Enforce a single policy choke point Route all model, tool, MCP and inter-agent traffic through one gateway so identity, policy and logging cannot be bypassed by a side path.
• Assign one identity per agent Replace shared API keys with scoped credentials per agent and bind every call to the task and user context behind it.
• Set budgets at three levels Cap tokens and calls per request, per run and per agent per day so a looping workflow is cut off before it spreads.
• Record denied calls as governance evidence Keep approvals, denied requests and policy versions in the audit trail so reviewers can prove which controls actually fired.

Key takeaways

• Agentic AI creates a governance problem where identity, policy and spend must be enforced across the full workflow, not just at the first request.
• The article’s evidence points to a control gap across MCP adoption, token growth and missing OAuth, which makes shared credentials and weak tracing especially risky.
• Practitioners should focus on per-agent identity, a single enforcement point and hard runtime budgets before multi-agent chains become unreviewable.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Security Guide · MCP Security Guide · AI Agent Authorisation Guide

Key terms

• AI Gateway: A control point that sits between AI applications and the models, tools, or data they call. In practice, it can authenticate requests, enforce policy, inspect runtime behaviour, and stop unsafe actions before they spread into connected systems.
• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Token Budget: A token budget is the amount of text capacity allocated to a model response, including in some systems the hidden reasoning steps that occur before output. If the budget is too small, the answer may truncate, disappear, or fail without a clear error condition.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.