Kong and Straiker show why agentic control loops matter

At a glance

What this is: This is an analysis of a Kong and Straiker integration that connects AI gateway enforcement with agent discovery, adversarial testing, runtime protection, and an Agentic Kill Switch.

Why it matters: It matters because identity teams now have to govern not only access to tools and data, but also the point where an AI agent must be contained when transaction-level blocking is no longer enough.

By the numbers:

• Straiker reports a 98.1% true-positive rate for its purpose-built runtime detection.
• Across successful attack scenarios, 85% involved agents operating beyond their intended authority.

👉 Read Straikerai's analysis of the Kong and Straiker agentic control loop

Context

AI gateway control is becoming a security boundary for agentic systems because it sits on the traffic path where models, MCP calls, and agent-to-agent interactions are brokered. In this article, Straikerai argues that the gateway is only part of the problem, since a valid connection can still carry a malicious instruction or lead an agent to misuse an authorized tool.

For IAM and NHI practitioners, the material question is how to govern agent behavior once the actor has legitimate access to tools and services. That shifts the focus from simple request approval to inventory, adversarial testing, runtime enforcement, and containment for the agent itself.

This is a strong example of why agentic AI cannot be treated as a thin extension of application security. The governance problem is lifecycle-wide: discover what exists, test what can be abused, enforce live policy, and revoke the agent's ability to act when the risk persists.

Key questions

Q: How should security teams handle a compromised AI agent that keeps trying new actions after a block?

A: They should move from blocking single transactions to containing the actor. If an agent can keep reasoning after denial, the response has to include revoking tools, suspending the session, freezing memory, or taking the agent offline. The objective is to stop the source of action, not just the latest request.

Q: Why is an AI gateway not enough on its own for agent security?

A: A gateway can enforce traffic policy, but it does not fully explain what the agent is trying to do with that access. Agent security also requires discovery, adversarial testing, runtime context, and a way to contain the agent if malicious behavior persists. Without those layers, the gateway only sees one request at a time.

Q: When should teams move from runtime blocking to agent-level shutdown?

A: They should escalate when a blocked action does not end the malicious sequence. If the agent can re-plan, select another tool, or continue unsafe behavior through connected systems, then the containment boundary has shifted from the request to the actor. That is the point where shutdown or suspension becomes appropriate.

Q: Why are AI discovery tools not enough for agent governance?

A: Because discovery tells you what exists and how risky it looks, but it does not remove the credential that makes the action possible. A security team can still be left with standing OAuth grants, API keys, or connector secrets even after a platform identifies the agent as high risk.

Technical breakdown

How AI gateways become enforcement points for agent traffic

Kong AI Gateway sits in the path of model, MCP, and agent-to-agent traffic, which makes it a practical place to apply policy before requests reach downstream systems. The technical value is not simply routing. It is that gateway policy can centralize retries, provider access, token controls, and traffic mediation while giving a security layer enough context to judge whether the request is safe. Straiker then evaluates behavior and semantics around the agent, turning the gateway into a decision point rather than a passive relay.

Practical implication: security teams should treat the gateway as an enforcement surface for agent-specific policy, not just an integration convenience.

Why runtime detection is not enough without agent-level containment

Runtime detection can block a dangerous call, but an agent can keep reasoning and try another path after the first denial. That is the key difference between transaction control and actor control. Straiker's Agentic Kill Switch is designed for the latter by revoking tools, freezing memory, suspending the active session, or taking the agent offline when a single blocked request does not stop the behavior. In agentic systems, containment has to operate at the identity level because the actor can continue to generate new actions.

Practical implication: define when blocking a transaction is insufficient and when the agent itself must be disabled.

How adversarial testing maps attack paths before production

Straiker's Ascend AI runs multi-turn adversarial campaigns against agents, tools, and connected systems to identify prompt injection, tool manipulation, data exfiltration, remote code execution, and lateral movement paths that actually succeed. That matters because agent security failures are often emergent across several steps rather than visible in a single request. The test result becomes the evidence base for runtime policy, containment criteria, and change management when models, prompts, or MCP connections shift.

Practical implication: use adversarial testing as a pre-production control gate whenever agent permissions, tools, or workflows change.

NHI Mgmt Group analysis

Agentic control cannot stop at request approval: once an AI agent has independent runtime behavior, the security problem is no longer only whether one call should be allowed. The article shows why transaction-level guardrails are insufficient when the same actor can keep reasoning and try another path. Practitioners should treat the agent itself as the containment boundary.

The runtime approval model assumes the actor stops after denial, which does not hold for agents: that assumption was designed for request-response systems where a blocked transaction ends the interaction. It fails when the actor is autonomous enough to re-plan, select another tool, and continue execution without human approval. The implication is that governance must move from single-decision control to actor-level containment.

Identity blast radius: the dangerous unit is the agent plus its connected tools, not the prompt alone. The article repeatedly shows that valid access can still produce harmful outcomes when tools, MCP servers, and downstream systems are in scope. That is the same governance problem NHI teams face with over-privileged service accounts, except the agent can adapt mid-session. Practitioners should map the blast radius of each agentic identity and its connected estate.

Discovery, testing, runtime defense, and kill-switch capability belong in one lifecycle view: the article describes a closed loop, not four separate products. That is the correct governance pattern for autonomous systems because permissioning without testing, or testing without containment, leaves a gap at the point of failure. The field should stop treating agent security as a control list and start treating it as an operating model.

Governing AI agents is now a lifecycle issue, not a point-in-time review problem: the article's emphasis on changing models, prompts, tools, and MCP connections shows why static approvals age out quickly. When the actor can change behavior as conditions change, recertification has to be paired with live telemetry and enforced response paths. Security teams should expect continuous change, not stable scope.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That is why the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both matter when runtime behaviour outpaces static governance.

What this signals

Identity blast radius: agent security now hinges on how far a single agent can reach once it has legitimate access. The practical shift is from reviewing isolated permissions to controlling the combined reach of the agent, its tools, and its downstream systems.

With 80% of organisations already seeing agents act beyond intended scope, per AI Agents: The New Attack Surface report, governance is no longer about hypothetical misuse. Security teams need operational evidence that runtime policy, containment, and ownership all line up before scale increases.

The next phase of AI governance will reward programmes that can reconcile live inventory with observed behaviour. That means pairing internal control design with external guidance such as the NIST AI Risk Management Framework and treating agent shutdown criteria as part of normal operations, not an exception path.

For practitioners

• Map the agentic estate to a control point Use gateway traffic, model endpoints, MCP servers, and agent-to-agent paths to build a live inventory of what is actually connected and what can be enforced centrally.
• Test the agents that matter most first Run adversarial campaigns against the highest-risk workflows and record which prompt injection, tool manipulation, and lateral movement paths succeed before production rollout.
• Separate request blocking from actor containment Define escalation criteria that move from denying one unsafe action to revoking tools, freezing memory, suspending sessions, or taking the agent offline.
• Revalidate policy whenever the agent changes Recheck permissions, prompts, tool access, and MCP connections after each workflow or model update so runtime controls do not lag the actual deployment.
• Tie containment to identity ownership Assign clear operational ownership for each agentic identity, including who can approve shutdown, who can restore access, and who reviews the evidence after containment.

Key takeaways

• Agentic AI security breaks when teams only govern the request and ignore the actor that keeps acting after denial.
• The article shows a closed loop of discovery, adversarial testing, runtime defense, and containment because one control layer is not enough.
• Practitioners should define when an agent must be suspended or taken offline, not just when a single action should be blocked.

Key terms

• Agentic control: Agentic control is the set of policies and enforcement points that govern what an AI agent can do at runtime. It focuses on tool access, execution boundaries, and downstream impact, rather than only on prompt content or post-event monitoring.
• Agent-level containment: A response pattern that stops the actor itself, not only the current request. For AI agents, this can mean revoking tools, freezing memory, suspending sessions, or taking the agent offline when repeated unsafe actions show that request blocking is insufficient.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Straikerai's full blog post covers the operational detail this post intentionally leaves for the source:

• The end-to-end Kong and Straiker integration pattern for AI gateway enforcement and agent-specific security decisions.
• How Discover AI, Ascend AI, Defend AI, and the Agentic Kill Switch fit together in a production operating model.
• The runtime flow for evaluating agent traffic, returning a verdict, and escalating to containment when risk persists.
• Deployment guidance for teams already using Kong AI Gateway and wanting to operationalise the control loop.

👉 The full Straikerai post covers gateway enforcement, adversarial testing, runtime protection, and agent-level containment details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.