TL;DR: AI gateways are becoming commodity infrastructure, but routing and logging alone cannot govern agentic systems because approved agents can still take unintended actions faster than humans can review them, according to JetStream Security research. The control problem shifts from request handling to runtime authorisation, approved design enforcement, and action-level policy.
At a glance
What this is: This is an editorial on AI gateway limits, arguing that gateway-only controls are insufficient and that enterprises need a broader control plane for agentic systems.
Why it matters: It matters because IAM and security teams must decide whether they are governing agentic action at the point of request, or only observing it after execution.
Context
AI gateways centralise traffic handling, but the governance gap appears when an approved agent begins taking actions that do not match the intended design. The core problem is not simple connectivity, but whether runtime decisions can be constrained at the moment the action is issued.
For agentic systems, the control question moves beyond authentication and routing. Practitioners need to govern who or what is acting, which approved design authorises the action, and whether the action itself is still within scope before execution starts.
Key questions
Q: What breaks when an AI gateway lacks enterprise governance features?
A: Without enterprise governance, teams often lose auditability, enforceable access control, and consistent policy enforcement. That creates blind spots for compliance, incident investigation, and change control. It also makes it harder to prove who accessed what, when routing decisions changed, or whether sensitive workloads were handled under the right restrictions. Those gaps become serious in regulated environments.
Q: Why do agentic systems need runtime authorisation instead of static permissions?
A: Static permissions describe what an agent can generally reach, but runtime authorisation decides whether that specific action, at that specific moment, is acceptable. That matters because the requester, tool and target can change the effective authority of the action. Without runtime evaluation, organisations approve capabilities without governing how they are actually combined.
Q: How should teams govern MCP tools that expose both safe and destructive actions?
A: They should treat the tool surface as a privilege boundary and authorise specific functions, not the whole connector. If a server can read, write, and delete, the policy should separate those capabilities and constrain parameters as well. Otherwise, the agent inherits more authority than the workflow actually requires.
Q: How do organisations decide whether an AI control plane is necessary?
A: An AI control plane becomes necessary when the organisation needs to decide whether a request should move at all, based on who is asking, what approved design authorises them, which tool is involved, and what the action will do. If those decisions are separated from transport, the gateway alone is not enough.
Technical breakdown
Why an AI gateway is not the same as an AI control plane
An AI gateway typically proxies requests, applies basic guardrails, and logs activity. A control plane adds policy that evaluates the action itself, the identity behind it, and the approved design that authorises it. That distinction matters because a request can be authenticated and still be unsafe, especially when the agent can chain tools, select parameters, or continue acting without a new human decision. The control plane is therefore not just a traffic layer. It is a governance layer that decides whether the specific action should proceed. See the AI Governance Platform Buyer's Guide.
Practical implication: Treat the gateway as a transport control, not as sufficient runtime governance.
Why approved agent design has to become a governed object
The article’s blueprint concept reflects a broader control problem: enterprises need a versioned record of which models, tools, datasets, and identities an agent is allowed to use. Without that approved design, runtime controls have nothing stable to compare against. Drift can happen when a model changes, an MCP server appears, or the sequence of actions no longer matches the authorised workflow. Governance therefore shifts from static approval of a tool to continuous validation of the agent’s operating pattern. See the Agentic AI Security Policy Template.
Practical implication: Govern the agent’s design as a controlled artefact, not just its credentials or network path.
Why MCP traffic needs policy at the tool and parameter level
MCP is where agents move from conversation to execution, so governance has to look inside the tool invocation rather than stop at the connection. If a server exposes both read and delete capabilities, the control plane should be able to permit one and deny the other, and ideally constrain the parameters attached to the call. That is more precise than coarse access decisions because the risk is not merely that the server is reachable, but that the agent can invoke a harmful function with legitimate credentials. See the Shadow AI and AI Agent Discovery Guide.
Practical implication: Apply action-scoped policy to MCP calls instead of treating all tool access as equivalent.
Threat narrative
Attacker objective: The objective is to use legitimate agent access to execute unauthorised actions without triggering timely governance controls.
- Entry occurs when an approved agent authenticates successfully and begins using a gateway or connector path that appears legitimate.
- Escalation happens when the agent continues acting beyond the intended design, including invoking tools, datasets, or parameters that were not meant for that workflow.
- Impact follows when the system only detects the action after execution, at which point the agent has already sent data, changed state, or expanded its reach.
Breaches seen in the wild
- Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.
- 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI gateway-only governance is an incomplete control model: A gateway can route, log, and lightly constrain traffic, but it does not answer whether the action itself was authorised at runtime. Once agents can choose tools and continue acting without a new human gate, the control boundary has to move from transport to action. The practical conclusion is that gateway adoption without action-level policy leaves a governance gap that will surface as soon as an approved agent behaves outside expectation.
Approved design must become a first-class identity control object: Versioned agent blueprints are not documentation for auditors, they are the reference state for runtime enforcement. That matters because model drift, connector drift, and tool drift all change what the agent can do even when the original approval has not changed. Practitioners should treat the approved design as the system of record for identity, access, and allowed behaviour.
MCP is a privilege boundary, not just an integration layer: Once an agent can invoke tools through MCP, the real control question becomes which functions it may call and under what conditions. A read-only connector and a destructive connector are not equivalent, even if they sit behind the same authenticated channel. This is why agentic governance has to become action-scoped rather than session-scoped.
Control failure now includes after-the-fact detection with no containment: The article describes a pattern where the gateway logs the action only after the agent has already acted. That is a structural weakness, not a monitoring gap. The implication is that runtime governance must be able to deny or contain before the action completes, or the control plane is only evidence collection.
Read next: AI Governance Platform Buyer's Guide
What this signals
AI gateway commodity pressure will keep rising: As more teams adopt basic gateways, differentiation will shift toward runtime governance, approved design enforcement, and action-scoped policy. The organisations that avoid governance debt will be the ones that treat the gateway as plumbing and the control plane as the real security decision point.
Runtime governance will become a board-level identity question: Once approved agents can act faster than review cycles, identity teams have to decide whether their programme governs authentication only or also governs what the authenticated actor is allowed to do in the moment. That is a materially different operating model for AI systems than for traditional applications.
Agentic control will converge with broader identity lifecycle thinking: The same discipline that governs joiner, mover, and leaver states now has to extend to agent blueprints, connector provenance, and retirement of agent privileges when the workflow changes. Without that lifecycle view, the estate accumulates approved but obsolete authority.
For practitioners
- Define the control plane boundary Separate transport handling, identity proofing, approved design validation, and action authorisation so each control has a distinct enforcement point.
- Inventory every agentic integration path Map which agents, MCP servers, datasets, and cloud services can execute without human approval, then identify where policy is only logged rather than enforced.
- Bind policy to the action, not only the session Set controls at tool and parameter level so a permitted read action cannot implicitly grant delete, write, or exfiltration capability.
- Require attested connector provenance Allow only reviewed and cryptographically attested connectors in high-trust workflows, especially where public registries or auto-upgrades are involved.
Key takeaways
- AI gateway adoption does not remove the need for runtime authorisation, because authenticated agent requests can still execute unsafe actions.
- The control gap is not just technical routing, it is the lack of policy at the action level, inside the tool call and across the approved design.
- Enterprises need governance that can compare live behaviour with the authorised blueprint before the action completes, not only after it is logged.
Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · AI Governance Platform Buyer's Guide · Agentic AI Security Policy Template
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on runtime abuse of agent identity and authority. |
| ASI02 — Tool Misuse | The core risk is unsafe tool invocation through connectors and MCP paths. | |
| Recommendation — Bind agent actions to explicit privilege boundaries and deny tool use outside the approved design. Restrict tools and parameters so agents cannot invoke destructive actions beyond their task scope. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Agents and connectors are treated as non-human identities with excess authority. |
| NHI-03 — Vulnerable Third-Party NHI | The article discusses supply chain risk in MCP servers and gateway-adjacent components. | |
| Recommendation — Review agent credentials and connector scope to remove unnecessary authority before deployment. Verify third-party connectors and attested packages before allowing them into production workflows. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The piece is fundamentally about governing who may act and under what authority in AI systems. |
| Recommendation — Establish governance for agent approvals, runtime oversight, and accountability for AI actions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The control plane discussion maps to authorization of agent actions and entitlements. |
| Recommendation — Apply entitlement governance so agent permissions are authorised, limited, and continuously reviewed. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article references credential harvesting and lateral movement in a supply chain incident. |
| Recommendation — Map agent and connector compromises to credential access and lateral movement in detection workflows. | ||
Key terms
- Atlas Control Plane: The Atlas control plane is the administrative layer for managing MongoDB Atlas resources such as database users, IP access lists, and cluster settings. When exposed to AI agents, it expands risk beyond data access into infrastructure and identity changes. That makes prompt injection and overbroad permissions much more dangerous.
- Agent Blueprint: An agent blueprint is the reusable definition for an AI agent’s permissions, allowed invokers, and session settings. It serves as the policy container that determines what the agent may do, who may start it, and how long its sessions can remain active.
- Action-level Policy: Action-level policy evaluates the specific function, parameter, or operation an agent is about to invoke instead of approving the entire session. This matters when the same connector exposes both low-risk and destructive capabilities, because the risk lives in the action, not the channel.
- MCP connector: An MCP connector is the integration component that lets an AI agent or application use the Model Context Protocol to reach external tools, data sources, or services. It translates protocol requests into tool-specific actions, handles authentication and context exchange, and helps govern what the agent can access, invoke, or retrieve.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing identity governance for modern systems, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org