TL;DR: Routing coding agents through an AI gateway captures tokens, cost, latency, and policy decisions, but it still misses reasoning, tool choices, and inbound context, according to Fiddler. Effective governance requires correlating gateway logs with agent-side telemetry before autonomy expands.
At a glance
What this is: This article argues that gateway telemetry gives only a partial view of coding agents because it records traffic and policy outcomes, not the reasoning, tool use, or inbound context that drive behaviour.
Why it matters: IAM and NHI teams need correlated agent and gateway telemetry because coding agents can touch secrets, tool endpoints, and production data without leaving a complete audit trail at the proxy layer alone.
Context
Coding agents are now part of the access surface, not just a developer convenience. When they can read repositories, call tools, and pull context from external systems, the governance question becomes whether security teams can explain what the agent saw, decided, and sent onward. Gateway telemetry helps, but it does not close the accountability gap by itself.
The identity angle is real because coding agents often operate with delegated credentials, API keys, and scoped tool permissions. If the monitoring model only watches traffic at the gateway, it misses the control point where a non-human identity interprets inbound context and turns it into an outbound action. That makes traceability, not just transport visibility, the core problem.
For regulated environments, this is typical rather than exceptional. Most organisations adopt coding agents faster than they build the telemetry needed to govern them, so the fleet expands before the oversight model does.
Key questions
Q: What breaks when coding agents are monitored only through an AI gateway?
A: Gateway-only monitoring captures traffic, tokens, latency, and policy decisions, but it misses the reasoning steps, tool choices, and inbound context that shaped the action. That means security teams can see that something happened without understanding why it happened. In regulated environments, that blind spot weakens accountability and makes it hard to prove whether the agent acted within policy.
Q: Why do coding agents need more than proxy logs for governance?
A: Proxy logs show transport, not intent. A coding agent can read a malicious tool response, absorb sensitive context, and then emit a risky action that looks ordinary at the gateway. Governance therefore depends on correlating network capture with agent-side traces so accountability survives a security review.
Q: What are the signs that a coding agent security control is failing?
A: A control is failing when benign-looking inputs can still trigger command execution, when skills or tools remain usable after the original task ends, or when untrusted content can influence agent actions across workflow boundaries. Repeated scanner bypasses, unexpected network access, and leaked environment variables are strong signals that the control is only screening content, not constraining execution.
Q: How should enterprises govern code agents without losing developer velocity?
A: Enterprises should treat code agents as runtime actors, not just code producers. The right model is unified visibility, centralized policy enforcement, and identity-backed control across all agent workflows. That means discovering shadow tools, restricting tool calls by context, monitoring for prompt injection, and blocking sensitive data movement before the agent can silently undermine security posture.
Technical breakdown
Why gateway telemetry is incomplete for coding agents
An AI gateway sees the request and response at the network boundary, which makes it useful for counting tokens, measuring latency, and enforcing coarse policy. It does not see the agent's internal reasoning steps, the sequence of tool calls, or the retrieved content that shaped the final output. In agentic systems, the most important security context often exists inside the loop, where the proxy has no native line of sight. That means a blocked request or an anomalous response is only an observable symptom unless the agent's own telemetry is available for correlation.
Practical implication: Treat gateway telemetry as a boundary signal, not a complete control plane, and correlate it with agent spans before you trust the output.
How inbound context changes coding agent risk
Coding agents do not only send data out, they also ingest data in through tool responses, web fetches, MCP servers, and other connectors. That inbound material can include secrets, PII, or malicious instructions that alter the next action the agent takes. Because the gateway usually records the payload after the decision path has already been formed, it cannot explain which inbound document or tool response triggered the later behaviour. The security problem is therefore causal traceability: you need to connect the context the agent received to the action it produced.
Practical implication: Log and inspect inbound tool data alongside the agent trace so you can prove which context influenced a risky action.
Why correlated telemetry is the governance minimum
Full monitoring joins the gateway record with agent-side telemetry using a shared trace or session identifier. OpenTelemetry-style spans, tool-call traces, and token usage data provide the internal timeline, while the gateway provides the external transaction record. Together they let teams attribute cost, detect loops, and trace a suspicious output back to the decision chain that created it. Without that join, governance remains descriptive rather than explanatory, which is not enough once agents can touch production repositories, secrets, or regulated data.
Practical implication: Standardise a correlation identifier across agent and gateway layers so every significant action can be reconstructed end to end.
Threat narrative
Attacker objective: The attacker wants to influence the agent's internal decision path so that sensitive data or unsafe actions emerge as legitimate-looking agent output.
- Entry occurs when a coding agent receives untrusted inbound content through tool output, web fetches, or MCP-backed context rather than through a simple outbound request.
- Credential access or misuse follows when the agent reads secrets or sensitive material from its working context and incorporates it into a later action or response.
- Impact appears when the resulting output leaks credentials, exfiltrates proprietary code, or executes an unsafe tool action that changes production data or resources.
Breaches seen in the wild
- Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
- PocketOS database deletion incident: An AI coding agent found an over-privileged Railway API token in the codebase and deleted PocketOS production data and backups in nine seconds.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Gateway telemetry is a boundary control, not a governance control. It tells you what crossed the wire, but not what the agent understood, prioritised, or decided after receiving it. That distinction matters because coding agents behave through chains of tool calls and retrieved context, not single-shot prompts. Practitioners should treat proxy logs as necessary evidence, not sufficient oversight.
Internal coding agent monitoring is the named control gap here: decision traceability. The real failure is not merely missing logs, but missing linkage between the inbound context, the internal reasoning step, and the outbound action. Without that chain, teams cannot explain whether a risky output was accidental, induced, or policy-breaking. Practitioners should make traceability a design requirement before expanding agent permissions.
Non-human identity governance now extends into the agent loop. Coding agents are effectively non-human actors with delegated access, and their risk profile is defined by what they can see, invoke, and emit. That makes agent-side telemetry part of NHI governance, not a separate observability concern. Practitioners should govern the agent as an identity-bearing system, not as a passive application.
Observability must precede autonomy. The moment a team grants broader access than it can audit, it creates an accountability gap that no downstream log review can fully repair. This does not mean freezing adoption, but it does mean sequencing access after traceability. Practitioners should expand capability only when they can reconstruct agent decisions end to end.
Correlated monitoring is the control pattern that will separate mature programmes from pilot deployments. Gateway-only oversight can handle cost and traffic management, but it cannot support confident policy enforcement in regulated or production environments. The practical conclusion is straightforward: if you cannot correlate, you cannot govern with confidence.
From our research library:
- 7% of security leaders admit they do not know how often their AI systems are making autonomous changes to infrastructure, according to the 2026 Infrastructure Identity Survey.
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Decision traceability is the new control boundary for coding agents. Teams that only measure traffic, latency, and cost are observing the network, not governing the actor. The practical shift is to design telemetry so the agent's inbound context, internal steps, and outbound action can be reconstructed together.
Non-human identity governance now extends to agent-side evidence. A coding agent with delegated access behaves like an identity-bearing system, so monitoring must capture more than proxy events. That means treating tool calls, reasoning traces, and correlation IDs as part of access governance rather than as optional logging.
If you cannot correlate a coding agent's context to its output, you do not yet have enough evidence to expand autonomy safely. Observability is the precondition for enforcement, and enforcement is the precondition for broader access.
For practitioners
- Implement correlated agent and gateway telemetry Propagate a shared trace or session identifier from the coding agent into gateway logs so each request can be reconstructed with its internal decision chain.
- Instrument agent-side spans and tool calls Capture reasoning steps, tool invocations, and retrieved context with agent-side telemetry so the gateway record can be explained rather than guessed.
- Limit payload logging by default Record metadata, policy outcomes, and correlation IDs first, then gate full prompt and response capture behind redaction, sampling, and retention rules.
- Inventory every coding agent in use Map sanctioned and unsanctioned agents across developer teams, because unmonitored local setups create coverage gaps that proxy controls cannot close.
- Apply inline enforcement for high-risk outputs Use allow, block, and redact decisions on the request and response path when telemetry shows secrets exposure, prompt injection, or unsafe tool use.
Key takeaways
- Gateway telemetry shows what coding agents send and receive, but it does not explain why the agent chose a tool, a response, or a risky action.
- The control gap is causal traceability, because untrusted inbound context can shape downstream agent behaviour outside the proxy's field of view.
- Teams need correlated agent and gateway telemetry before they widen permissions, otherwise they are expanding access faster than they can govern it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Coding agents operate with delegated access and can misuse tool permissions or credentials. |
| ASI02 — Tool Misuse | The article centres on tool calls, inbound context, and unsafe actions inside the agent loop. | |
| ASI07 — Insecure Inter-Agent Communication | Gateway and agent telemetry must be correlated across communication boundaries to explain behaviour. | |
| Recommendation — Constrain agent privileges and trace every tool action to the identity that initiated it. Review agent tool permissions and block unsafe tool paths before they can execute. Authenticate and correlate agent communications so decision traces remain attributable across systems. | ||
| NIST AI RMF | MANAGE — Manage AI Risks | The post is about operational AI oversight and control escalation as autonomy increases. |
| Recommendation — Operationalise AI risk controls before increasing agent autonomy or production access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Coding agents need governed permissions, not just observed traffic, to prevent unsafe access. |
| Recommendation — Review agent entitlements against actual task scope and remove unused access paths. | ||
| MITRE ATT&CK | TA0006;TA0009 — Credential Access; Collection | The article discusses secret leakage, malicious tool output, and collection of sensitive context. |
| Recommendation — Map agent telemetry gaps to credential access and collection techniques in your detections. | ||
Key terms
- Agent-side Telemetry: Telemetry emitted by the coding agent itself about its internal reasoning, tool calls, and execution path. It reveals why an action happened, not just what crossed the network boundary, and it is essential for explaining behaviour that gateway logs cannot interpret.
- Endpoint Telemetry: Endpoint telemetry is the process and event data collected from managed devices to understand local activity. For shadow AI, it includes process spawns, file access, and direct outbound calls from the operating system, giving security teams visibility that network tools and SaaS logs often miss.
- Correlation Identifier: A correlation identifier is a shared trace value used to link events from different systems into one chain of evidence. In coding agent monitoring, it connects gateway logs to agent spans so teams can trace a risky action back to the specific session, input, and tool call that produced it.
- Decision trace: The record of how an access decision was made, including inputs, policy logic, and the final allow or deny outcome. For AI-assisted identity systems, decision traces are necessary for auditability, troubleshooting, and proving that automated access was bounded and explainable.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org