Internal coding agent monitoring needs more than gateway telemetry

At a glance

What this is: This analysis shows that AI gateways provide useful traffic telemetry for coding agents, but they cannot explain the reasoning, tool use, or inbound context that produced a risky action.

Why it matters: For IAM and NHI practitioners, the gap matters because autonomous coding workflows depend on credentials, tool access, and context that must be observed and governed together.

By the numbers:

• 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
• 60% of NHIs are being overused, with the same NHI utilised by more than one application, increasing the risk of widespread compromise if exposed.

👉 Read Fiddler's analysis of internal coding agent monitoring and gateway blind spots

Context

Internal coding agent monitoring is a governance problem before it is a telemetry problem. AI gateways can record traffic, costs, and policy outcomes, but they do not reveal the reasoning steps, inbound tool output, or hidden context that shaped an agent's action. For teams running coding agents with shared credentials or access to source systems, that blind spot creates an identity and privilege governance gap.

The issue matters because coding agents increasingly behave like non-human identities in the software delivery chain. They consume secrets, call tools through MCP-style integrations, and can carry sensitive content into downstream decisions. Without agent-side telemetry, security teams see the request and response, but not the identity, decision path, or data exposure that made the session risky.

Key questions

Q: What breaks when coding agents are monitored only through an AI gateway?

A: Gateway-only monitoring captures traffic, tokens, latency, and policy decisions, but it misses the reasoning steps, tool choices, and inbound context that shaped the action. That means security teams can see that something happened without understanding why it happened. In regulated environments, that blind spot weakens accountability and makes it hard to prove whether the agent acted within policy.

Q: Why do coding agents need more governance than ordinary application traffic?

A: Coding agents can select tools, consume inbound context, and forward sensitive data into downstream actions, so they behave like operational non-human identities rather than passive clients. Standard proxy monitoring is not enough when the system can reason across steps and alter its own path. Governance has to cover identity, privilege, context, and traceability together.

Q: How do security teams know whether agent telemetry is actually working?

A: Telemetry is working when it captures tool calls, lifecycle events, and message traces in a way that supports investigation and correlation. If logs omit tool execution or are easy to alter, the control has failed. Durable output with redaction and forwarding to monitoring systems is the practical test.

Q: Who is accountable when a coding agent leaks secrets or makes an unsafe tool call?

A: Accountability should sit with the team that owns the agent's access scope, telemetry, and policy enforcement, not with the gateway alone. The gateway is only one control point. In practice, organisations need clear ownership for the non-human identity, the data it can see, and the conditions under which it can act.

Technical breakdown

Gateway telemetry captures traffic, not decision-making

An AI gateway sits between the coding agent and the model provider, so it can log request counts, token usage, latency, cost, and policy outcomes. That is useful for budgeting and basic governance, but the proxy only sees what crossed the wire. It does not see the agent's internal reasoning, the sequence of tool calls, or the retrieved content that shaped the final output. In identity terms, the gateway observes traffic from the non-human identity, but not the decision context that gave the action meaning.

Practical implication: treat gateway telemetry as necessary but incomplete, and pair it with agent-side tracing before granting broader tool access.

Why agent-side telemetry is required for coding agent governance

Agent-side telemetry captures the internal loop that gateway logs miss. OpenTelemetry spans can record model calls, tool invocations, token usage, and correlation identifiers that link a decision to a specific session or developer. When that trace is joined to gateway logs, security teams can reconstruct the chain from inbound content to tool decision to outward request. This is the difference between seeing a suspicious API call and understanding whether it came from prompt injection, reasoning drift, or a legitimate workflow.

Practical implication: instrument agents with shared trace identifiers so every risky action can be traced back to the originating context.

Inline enforcement depends on correlated visibility

Monitoring alone only helps after the fact. Correlated visibility lets teams enforce policy on the agent's request and response path, where sensitive content can be redacted, blocked, or allowed in real time. In practice, that requires policy decisions that cover both data leaving the gateway and the context entering the agent from tools, web fetches, or MCP servers. For autonomous coding workflows, governance has to move from observation to control.

Practical implication: build enforcement around correlated traces so access control can act before secrets or PII move beyond policy boundaries.

Threat narrative

Attacker objective: The attacker wants to manipulate the agent's internal decision path so it discloses sensitive data or executes an unsafe action under legitimate-looking telemetry.

1. Entry occurs when a coding agent receives untrusted inbound context from tool output, web fetches, or an MCP-connected endpoint.
2. Escalation happens when the agent interprets that input inside its internal loop and turns it into a tool call or outbound request that the gateway cannot causally explain on its own.
3. Impact follows when the agent leaks a secret, forwards sensitive code, or acts on malicious instructions while appearing normal at the proxy layer.

NHI Mgmt Group analysis

Observability-first governance is now a prerequisite for safe autonomy. Coding agents can make decisions faster than human review loops, which means teams cannot rely on traditional access review after the fact. The control question is no longer whether the gateway records usage, but whether the organisation can explain how a non-human identity reached a tool decision. Practitioners should widen access only when they can correlate request, context, and action.

Gateway-only monitoring creates a context blind spot that identity teams should treat as a control gap. The gateway sees traffic, but not the inbound data that shaped the agent's behaviour, and that matters when the agent consumes secrets or sensitive documents through MCP-linked tools. This is a named failure mode: correlated context loss. It is the point where identity governance, data governance, and AI control all break at once, so teams need shared traceability across those layers.

Coding agents are becoming operational non-human identities, not just application traffic. Once an agent can choose tools, call services, and forward data, its behaviour needs lifecycle governance similar to other privileged machine identities. That does not mean treating every agent as fully autonomous, but it does mean assigning ownership, scope, and auditability before the tool surface expands. The practitioner conclusion is simple: agent identity governance must be explicit, not inferred from proxy logs.

The most practical control is correlation, not more logging. Adding more payload logging without joining it to agent-side spans increases storage risk without improving explanation. A correlated trace lets security teams distinguish benign token spikes from malicious prompt injection, accidental leakage, or policy drift. For regulated environments, that is the line between observability and accountability.

Agent monitoring will increasingly converge with NHI governance. The same lifecycle questions that apply to service accounts now apply to coding agents that invoke tools, consume credentials, and influence production workflows. As agent fleets grow, identity teams will need to decide which controls belong in the gateway, which belong in the agent, and which belong in policy attached to the non-human identity itself. The field is moving toward traceable, scoped, and revocable agent access, and teams should prepare accordingly.

What this signals

Correlated visibility will become the minimum viable control for agentic coding environments. Teams that only monitor gateway traffic will keep missing the context that turns a benign request into a risky act. The operational shift is toward joined traces across agent, tool, and gateway layers so policy decisions can be explained, not just logged.

Secret exposure risk rises when coding agents are treated as ordinary application clients. The same lifecycle and access issues that affect other non-human identities now apply to agents that can fetch data, call tools, and move sensitive content across systems. That means identity teams should prepare to govern agent permissions, context boundaries, and offboarding with the same seriousness they apply to service accounts.

AI gateway data is useful, but it should be paired with governance resources such as the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework. Those references help teams translate telemetry into control objectives, especially where prompt injection, tool misuse, and context poisoning create identity-adjacent risk.

For practitioners

• Correlate agent and gateway telemetry Assign a shared trace identifier to each coding agent session, then log that identifier at both the agent and gateway layers so every request can be traced back to the tool call and inbound context that produced it.
• Limit access until context can be observed Do not expand tool or data access for coding agents until the organisation can see what enters the agent from MCP servers, web fetches, and other inbound sources, not just what exits through the gateway.
• Redact sensitive payloads by default Keep payload logging off by default and use inline redaction for secrets, tokens, and PII so the observability pipeline does not become a secondary data exposure path.
• Inventory every coding agent instance Track sanctioned, local, and developer-run agents separately, because unmonitored deployments create coverage holes that make gateway-based policy enforcement incomplete.

Key takeaways

• Gateway telemetry is useful, but it cannot explain the reasoning or inbound context that drives a coding agent's action.
• When coding agents consume secrets and tool output, they behave like governed non-human identities and need correlated traceability.
• The practical control shift is from more logging to joined observability, inline policy, and explicit ownership of agent access.

Key terms

• AI Gateway: A control point that sits between AI applications and the models, tools, or data they call. In practice, it can authenticate requests, enforce policy, inspect runtime behaviour, and stop unsafe actions before they spread into connected systems.
• Agent-Specific Telemetry: Agent-specific telemetry is logging that captures an AI agent's prompt, plan, tool selection, execution, and outcome. It goes beyond standard system logs by preserving the decision context needed to explain autonomous behaviour under audit or incident review.
• Correlation Identifier: A correlation identifier is a shared trace value used to link events from different systems into one chain of evidence. In coding agent monitoring, it connects gateway logs to agent spans so teams can trace a risky action back to the specific session, input, and tool call that produced it.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

Fiddler's full blog covers the operational detail this post intentionally leaves for the source:

• The specific AI gateway capture fields and observability categories used for coding agent traffic
• The agent-side telemetry pattern built with OpenTelemetry and shared trace identifiers
• The inline enforcement model for redaction, blocking, and policy decisions on the request path
• The latency and payload-handling trade-offs that appear when monitoring is moved into production

👉 The full Fiddler post details how to join gateway telemetry with agent-side traces for enforceable visibility.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners build lifecycle controls for the non-human identities now shaping modern delivery pipelines.