Claude Code governance needs an AI gateway control plane

At a glance

What this is: This is a Kong analysis of Claude Code governance that argues AI coding agents create unmanaged LLM traffic unless an AI gateway sits between developers and model APIs.

Why it matters: It matters because IAM, security, and platform teams need controls for model access, prompt logging, data leakage, and spend governance before agentic coding becomes normalised.

Context

Claude Code is an agentic coding tool that can read codebases, edit files, run commands, and iterate across multiple steps from natural language instructions. That makes it more than a code helper, because it creates a new identity and traffic pattern: a developer-directed agent moving proprietary context to an external model endpoint.

The governance gap is central. When a coding agent can operate across repositories, tools, and prompts, existing API management and DLP assumptions are no longer enough on their own. The question for identity and security teams is how to control model access, data flow, and auditability without breaking the developer workflow.

Kong frames the problem as an LLM governance issue, not a model-quality issue. The starting point is typical for teams adopting AI-assisted coding at scale: capability arrives faster than the control plane built to govern it.

Key questions

Q: What breaks when Claude Code sessions bypass a central AI gateway?

A: When Claude Code connects directly to a model endpoint, organisations lose consistent policy enforcement, audit logging, data redaction, and cost controls. The result is not just higher risk, but fragmented governance across teams, because each developer path can behave differently. A central gateway is the control point that makes the session governable.

Q: Why do AI coding agents create access and governance risk even when they are not autonomous?

A: Because they already operate with tool access, repository access, and execution permissions inside a live workflow. That means the risk comes from delegated authority, not just independence. Even partially supervised agents can still manipulate sensitive code, secrets, or deployment paths if their permissions and review boundaries are loose.

Q: How can teams tell whether LLM governance is actually working?

A: Look for evidence that model access is scoped, tool use is logged, sensitive outputs are blocked or reviewed, and poisoned context fails closed. If teams cannot trace prompts, retrieval sources and actions end to end, governance exists on paper but not in practice.

Q: What is the difference between direct Claude Code access and an AI gateway?

A: Direct access sends prompts and context straight to the model provider, with governance left to each client or team. An AI gateway mediates that traffic, adding unified authentication, logging, filtering, routing, and usage controls. For enterprise use, the gateway turns an unmanaged integration into a policy-enforced control plane.

Technical breakdown

Why Claude Code creates a new traffic class

Claude Code is described as an autonomous agentic coding tool, not a simple autocomplete assistant. It can inspect codebases, spawn subagents, execute commands, and call external tools through MCP, which means its runtime behaviour is stateful and context-rich. From an identity perspective, that creates a machine-mediated trust path between a developer session and external AI services. The security issue is not only authentication to the model API. It is the absence of policy enforcement across prompts, outputs, tool calls, and the sensitive context that moves with each request.

Practical implication: treat AI coding sessions as governed machine traffic, not as ordinary developer API calls.

What an AI gateway adds to LLM governance

An AI gateway functions as a control plane for model traffic. In Kong’s framing, it centralises authentication, rate limiting, logging, content filtering, provider routing, and policy enforcement so that individual clients do not connect directly to model endpoints. That matters because the governance problem sits between the user and the model, not inside the model itself. The gateway becomes the enforcement point for who can send prompts, what data can leave the environment, which models are reachable, and how usage is recorded for audit and chargeback.

Practical implication: put policy, logging, and redaction at the traffic layer where every request can be inspected and governed.

How MCP expands the governance boundary

Claude Code does not stay confined to code generation when MCP and external tools enter the picture. Once the agent can reach systems such as ticketing, storage, or collaboration tools, the governance boundary widens from model access to tool access and context exposure. That changes the risk profile from simple prompt leakage to over-broad delegated access across enterprise systems. In practice, the control problem starts to look like non-human identity authorisation, because the agent is now acting through a chain of permissions rather than through a single interactive session.

Practical implication: extend governance from model prompts to the downstream tools and data sources the agent can invoke.

Threat narrative

Attacker objective: The objective is not a classic intrusion but uncontrolled exposure of proprietary code, sensitive context, and governance blind spots through ungoverned AI coding sessions.

1. Entry begins when a developer or team adopts Claude Code and sends code context, prompts, and commands to an external model endpoint without a central control layer.
2. Credential and context exposure occur when the session includes proprietary source code, environment variables, API keys, or customer data that travel with the request path.
3. Impact follows as the organisation loses auditability, policy enforcement, and cost visibility, while shadow AI fragments usage patterns across teams.

Breaches seen in the wild

• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI coding governance is becoming a control-plane problem, not an application feature problem. Claude Code changes the shape of risk because it creates high-context, high-volume LLM traffic that needs policy, logging, and enforcement independent of the model provider. Traditional gateway patterns apply, but only if teams accept that the security boundary is now between the developer session and the model endpoint, not inside the IDE. The practitioner conclusion is clear: governance has to sit on the path of every request.

LLM traffic requires the same lifecycle discipline that IAM applies to other delegated access. Developers are not the only subject here. The agent’s prompts, tool calls, and routed model access form a delegated execution path that should be governed as a non-human identity pattern, especially once MCP expands the tool surface. This is where least privilege, auditability, and data handling controls stop being abstract and become operational requirements. The practitioner conclusion is to govern the delegation chain, not just the developer account.

Prompt logging alone is not enough without enforcement at issuance time. If a session can send proprietary context before any downstream review occurs, the control has already failed. That means the meaningful governance point is request mediation, where redaction, rate limiting, model selection, and policy checks can still shape the outcome. The practitioner conclusion is to move control upstream, before data leaves the environment.

Claude Code exposes a shadow AI pattern when teams bypass a central LLM control plane. Different teams can end up using different models, policies, and routing paths, which makes spend management and compliance reporting unreliable. The named concept here is LLM governance sprawl: fragmented client-to-model paths that defeat consistent policy enforcement. The practitioner conclusion is to standardise the gateway layer before agentic coding becomes a collection of exceptions.

The market signal is that agentic coding is maturing faster than identity governance for AI workloads. The article’s core point is not that Claude Code is risky by itself, but that enterprise control models lag behind agent behaviour. That gap will only widen as more tools add autonomy, external tool access, and memory. The practitioner conclusion is to treat AI gateway governance as an identity programme extension, not an infrastructure afterthought.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

LLM governance sprawl: Once AI coding tools are adopted by multiple teams, the control problem shifts from a single integration to a distributed estate of prompts, models, and tools. That fragmentation weakens auditability and makes policy exceptions hard to detect, so security teams need one governed path for model traffic rather than many unofficial ones.

Claude Code illustrates why AI gateway controls are now part of identity governance for non-human actors. The useful control point is not post-hoc review of outputs, but mediation of the request itself, where redaction, authorisation, and logging can still shape what leaves the environment.

For practitioners

• Implement a central AI gateway for coding agents Route Claude Code traffic through a single mediation layer so authentication, routing, logging, and policy enforcement happen before requests leave the environment.
• Log prompts, responses, and model usage centrally Capture the user, model, token counts, latency, and response metadata for every agent session so compliance and platform teams can reconstruct activity.
• Redact sensitive data before model submission Apply prompt filtering for API keys, environment variables, customer data, and internal project terms so the agent cannot leak them upstream by accident.
• Govern MCP tool access as delegated non-human access Treat external tool connections as a separate authorisation problem and review which systems the agent can call through MCP and related integrations.
• Standardise model routing and provider abstraction Avoid hardcoding clients to a single provider endpoint so teams can change model backends without rewriting developer workflows or bypassing controls.

Key takeaways

• Claude Code introduces a governance problem because each session can move code, secrets, and business context through an external model path.
• The article’s core concern is the absence of central control, not the model itself, and that gap affects auditability, cost, and data protection.
• Security teams should mediate AI coding traffic through a control plane before agentic adoption turns local exceptions into enterprise-wide sprawl.

Key terms

• AI Gateway: A control point that sits between AI applications and the models, tools, or data they call. In practice, it can authenticate requests, enforce policy, inspect runtime behaviour, and stop unsafe actions before they spread into connected systems.
• Agent Harness: The agent harness is the runtime layer that wraps a model and turns it into an acting system. It usually includes the loop, tools, context handling, permissions, hooks, and logs. In security terms, it is often the real place where privilege sits and where identity evidence must be governed.
• LLM Governance Debt: LLM governance debt is the gap between rapid deployment of model-enabled workflows and the slower work of defining ownership, access control, auditability, and response procedures. It accumulates when teams scale use cases before establishing the controls needed to manage model behaviour safely.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.