MCP proxy governance is becoming the control plane for AI agents

At a glance

What this is: This is a practitioner analysis of MCP proxy architecture and its role in enforcing guardrails, auditability, and least-privilege tool access for AI agents.

Why it matters: It matters because IAM teams now have to govern agent-to-tool interactions as identity events, not just user logins, or they lose visibility, policy control, and containment.

By the numbers:

• The global AI agents market is valued close to $8 billion and projected to reach $236 billion by 2036.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

👉 Read Akto's analysis of MCP proxy governance for AI agents

Context

MCP proxy governance is the missing control layer when AI agents can dynamically call tools, APIs, and live data sources. The identity problem is not just whether an agent is authenticated, but whether each tool invocation is authorised, logged, and constrained to the agent’s current task.

Akto’s article frames the proxy as middleware between MCP clients and MCP servers, with routing, policy enforcement, protocol translation, and audit logging in one place. That framing is useful for security teams because it moves the discussion from generic AI safety to operational control of agent identity, tool scope, and outbound data flow.

For enterprise IAM and security architecture teams, the core issue is whether agent access is still being treated like application access. Once agents can chain tool calls across systems, the control point has to shift closer to execution, not after the fact.

Key questions

Q: How should security teams govern AI agents that choose tools at runtime?

A: Security teams should treat runtime tool choice as a governed access event, not a normal application call. That means task-scoped credentials, explicit approval boundaries for sensitive actions, and logs that record both the tool selected and the identity used. If the agent can change its plan, the control model must be able to change with it.

Q: Why do AI agents increase non-human identity risk?

A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission. That speed expands blast radius, shortens attacker dwell time, and makes weak delegation more dangerous. The remedy is tighter scoping, continuous verification, and strict separation between observation and execution privileges.

Q: What breaks when prompt injection is not controlled in agentic workflows?

A: When prompt injection is not controlled, the agent can follow malicious instructions hidden in web content and perform actions the user never intended. That creates a direct path from ordinary page content to unauthorized execution, which bypasses normal access-control thinking.

Q: How can organisations prove they have control over agent actions?

A: By keeping immutable logs for every request, response, and policy decision, then tying those records to specific agent identities and tool permissions. That evidence supports incident investigations, access review, and compliance questions. If the logs stop at the application boundary, the governance story is incomplete.

Technical breakdown

How MCP proxy enforcement works

An MCP proxy intercepts agent requests before they reach MCP servers, then applies routing, authentication, policy checks, and logging. In effect, it becomes a broker for tool access, similar to an API gateway but focused on agent-to-tool traffic. This matters because the proxy can inspect intent-bearing requests before execution, rather than relying on downstream services to reject unsafe calls. It also normalises communication across STDIO, HTTP, and SSE transports, which reduces the chance that a tool path bypasses policy simply because it speaks a different protocol.

Practical implication: Treat the proxy as the primary enforcement point and require every agent tool call to traverse it.

Prompt injection and tool abuse in agentic AI

Prompt injection becomes dangerous when a model can translate malicious instructions into real tool calls. The weakness is not only content manipulation but action delegation, where the agent turns untrusted input into privileged execution. If the proxy does not inspect and validate parameters, an injected prompt can push the agent toward unauthorized data retrieval, destructive commands, or exfiltration through approved tools. In this model, the security problem is execution control, not just text filtering.

Practical implication: Validate requests before execution and block tool calls that exceed the agent’s declared purpose.

Auditability and least privilege for agent workflows

A proxy can create a complete record of requests, responses, and denied actions, which is essential when agents operate at machine speed across multiple systems. That audit layer only helps if permissions are scoped narrowly by role, context, or task and centrally revocable. Without that combination, logging merely records overbroad access after the fact. For identity teams, the proxy is where least privilege becomes operational for non-human identities that are transient, distributed, and difficult to review manually.

Practical implication: Use the proxy to centralise entitlement changes and to retain a defensible audit trail for every agent action.

Threat narrative

Attacker objective: The attacker wants to turn the agent’s legitimate tool access into a channel for unauthorized execution, data leakage, or destructive system actions.

1. Entry occurs when a malicious prompt or compromised agent reaches a tool interface that lacks proxy enforcement, allowing unsafe instructions to enter the workflow.
2. Escalation follows when the agent converts those instructions into unauthorized tool calls, data retrieval, or outbound requests that exceed its intended scope.
3. Impact is realised through data exfiltration, destructive actions, or invisible misuse of internal systems because the security team lacks a complete audit trail.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP proxy governance is becoming the practical control plane for agentic AI. Once AI systems can choose tools at runtime, identity and access management has to move from login-centric thinking to invocation-centric thinking. A proxy is not just middleware, it is where authorisation, inspection, and auditability converge for non-human identities. Practitioners should treat agent-to-tool traffic as a governed identity path, not an application side effect.

Prompt injection is an execution problem before it is a content problem. The article correctly points to unsafe tool calls, but the deeper issue is that the agent can be manipulated into transforming untrusted input into authorised action. That means the governing control is not a content filter alone, but policy enforcement at the point of execution. Security teams should read this as a shift from message hygiene to action containment.

Least privilege is incomplete unless it is enforced at the proxy layer. Static permissions on the underlying MCP server do not solve the problem if an agent can still reach multiple tools through a permissive path. The named concept here is tool invocation blast radius: the number of systems an agent can touch before a human even sees the request. The smaller that blast radius, the more defensible the identity model becomes.

Visibility is now a governance requirement, not an operations bonus. When every agent action is logged centrally, teams gain the evidence needed for incident response, compliance, and access review. Without that record, agent behaviour becomes effectively ungoverned even if the tool stack looks secure on paper. Practitioners should assume regulators and auditors will eventually expect machine-action traceability, not just human authentication logs.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That visibility gap is why practitioners should also review OWASP Agentic Applications Top 10 for runtime controls and abuse paths.

What this signals

With 92% of organisations agreeing that governing AI agents is critical but only 44% having implemented policies, the operational gap is no longer about intent. Teams that are already piloting MCP proxy controls should treat them as the place where policy becomes enforceable, especially when agent workflows cross multiple tools and data domains.

Tool invocation blast radius: the real risk is not that an agent has access, but that one authenticated agent can touch too many systems before anyone notices. Security programmes should measure how many tool paths are reachable from a single identity and whether that number is shrinking over time.

For teams using the OWASP Top 10 for Agentic Applications 2026, MCP proxy logging and request inspection map directly to the need for runtime guardrails. The next maturity step is to tie those controls to identity lifecycle events so permissions change when the agent’s task changes.

For practitioners

• Enforce proxy-first tool access Route every AI agent request through a single MCP proxy so no server or API is reachable without policy inspection, routing control, and logging.
• Scope permissions by agent role and task Define the smallest usable tool set for each agent identity, then centralise revocation so access can be updated without editing each server configuration.
• Inspect outbound requests for data leakage Scan parameters and payloads before forwarding them to external tools or APIs, especially where prompts could cause the agent to disclose credentials, PII, or internal context.
• Keep immutable audit logs for agent actions Record the request, parameters, response, and policy decision for every tool invocation so investigations can reconstruct what the agent did and why.
• Test for prompt injection at the execution boundary Simulate malicious prompts against the proxy layer to verify that unsafe commands are blocked before the agent reaches downstream tools or databases.

Key takeaways

• MCP proxies turn agent-to-tool traffic into a governed identity path, which is essential when AI systems can make runtime decisions across multiple services.
• The main risk is not only prompt injection, but the conversion of untrusted input into authorised execution, data leakage, or destructive tool use.
• Identity teams need proxy-level enforcement, least privilege, and auditability if they want agentic AI to stay inside a defensible governance model.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Tool Invocation Blast Radius: The amount of systems, data, and actions a single agent can reach through one identity. In agentic environments, blast radius is measured by reachable tool paths and permissions at runtime, not just by initial login scope or static role design.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agent Audit Log: An agent audit log is a record of actions taken by an AI agent that preserves identity, authorisation, approval, and delegation context. It is designed for accountability rather than debugging, so it must support investigation, compliance review, and proof of who authorised what.

What's in the full article

Akto's full blog post covers the operational detail this post intentionally leaves for the source:

• Request-flow examples showing how the proxy intercepts, validates, forwards, and logs agent traffic.
• Configuration patterns for policy engines, authentication layers, and protocol adapters in mixed AI stacks.
• Use-case examples for copilots, developer assistants, automation agents, and customer support bots.
• Best-practice examples for restricting tool permissions and monitoring invocation patterns.

👉 Akto's full post covers the request flow, guardrail patterns, and AI agent use cases in more implementation detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.