MCP visibility gaps expose the governance problem in agentic AI

At a glance

What this is: NHI Mgmt Group's analysis, drawing on ValidMind's blog post: Agentic AI environments are spreading across multiple platforms and control layers, and fragmented observability leaves organisations without a single operational view of risk.

Why it matters: IAM, PAM and NHI teams need to treat visibility, policy enforcement and delegated access as one governance problem when agents, MCP servers and platform-native AI tools interact.

Context

Agentic AI governance is becoming harder because the control plane is no longer singular. Models, agents, MCP servers, skills and platform-native AI tools are distributed across multiple vendors and execution contexts, so teams inherit fragmented telemetry before they inherit a governance model. The issue is not just observability volume, but the lack of a shared operating picture across identity, policy and runtime behaviour.

This creates a familiar identity problem in a new form: policy can exist at the edge while behaviour happens elsewhere. When agents access tools through MCP servers and exchange signals with other agents, teams need to understand which layer made the access decision, which layer logged it, and which layer can actually enforce a boundary. Without that map, governance degrades into post hoc analysis rather than control.

The practical implication is that agentic AI programmes need to be governed as identity-bearing systems rather than as isolated models or dashboards. That framing matters because the trust boundary is now distributed across orchestration, access, telemetry and documentation.

Key questions

Q: How should teams govern agentic AI when MCP servers, observability tools and SaaS platforms are all separate?

A: Treat the runtime path as the governance unit. Teams need a shared inventory of agents, tools, policy decision points and logging systems so they can trace who approved access, what action occurred and where the evidence lives. If those layers are not aligned, governance becomes fragmented and enforcement is only visible after the fact.

Q: Why does fragmented observability create more risk in agentic AI than in traditional application monitoring?

A: Because agentic systems make decisions across multiple layers, not inside one application boundary. A partial log stream can show that something happened without showing why it happened, whether it was authorised or whether the behaviour crossed a policy line. That makes incident triage and governance evidence much harder to trust.

Q: What mistakes do security teams make when they treat MCP servers as just another integration component?

A: They often miss that MCP servers can act as policy enforcement layers and therefore shape what an agent may access in the first place. If teams do not govern those decision points explicitly, access controls become scattered across vendors and the real control boundary disappears into implementation details.

Q: What does agentic AI governance need that model validation alone does not provide?

A: It needs operational correlation across identity, action, documentation and enforcement. Model validation can tell you how a system should behave, but it does not prove what happened across tools, proxies and platforms during execution. Governance only becomes real when those layers are tied together in a single accountability chain.

Technical breakdown

Why MCP servers become policy enforcement layers

MCP servers sit between agents and the tools, models or data sources they are allowed to reach. In practice, that means the server is not just a transport component. It becomes a policy enforcement layer that decides what can be used, under what conditions, and sometimes with what context. The architectural problem is that this decision point is separated from the systems that generate observability data. As a result, the policy decision, the action, and the evidence of the action can live in different places. That separation makes investigation and governance difficult because the team must reconstruct intent and enforcement after the fact, rather than observe them in one place. See the MCP Security Guide.

Practical implication: map each MCP decision point to the systems that record, evaluate and enforce it.

How fragmented observability breaks agentic risk correlation

Agentic environments commonly split telemetry across observability tools, cloud platforms, cost dashboards and vendor-native AI consoles. Each source may be accurate on its own, but none of them is sufficient as a governance record. That fragmentation breaks correlation across time and across layers, so a hallucination, policy violation or misuse signal may be visible only in hindsight. The deeper issue is not missing data, but missing joins between identity, action and outcome. Without a coherent event model, teams cannot reliably tell whether an agent was compliant, misused or simply poorly instrumented. Governance becomes a stitching exercise instead of an operational discipline. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: build a normalised event model that ties agent identity, tool use and policy outcomes together.

Why skills and agent-to-agent proxies expand the trust boundary

Skills and A2A proxies widen the execution surface because they add more routes through which an agent can act, delegate or consume capability. That matters because every additional pathway creates a new place where authorisation, logging and documentation can diverge. If the organisation treats these components as convenience layers rather than identity and access surfaces, the trust boundary becomes fuzzy. A team may think it is controlling a single agent while the real behaviour is distributed across several intermediary services. The result is governance that looks complete in diagrams but incomplete in runtime. See the AI Agent Authorisation Guide.

Practical implication: treat skills and A2A proxies as governed access paths, not just integration plumbing.

Threat narrative

Attacker objective: The practical objective is to exploit fragmented governance so that risky agent behaviour proceeds without timely detection or containment.

1. Entry occurs when agentic systems are distributed across MCP servers, SaaS platforms and orchestration layers with no unified control plane.
2. Credential and policy context become harder to track because each platform emits partial telemetry rather than a complete execution record.
3. Impact follows when hallucinations, misuse or policy violations surface only after the downstream action has already propagated.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance fails first at the control plane, not at the model. The article describes a world where models, agents, MCP servers, skills and dashboards are all separate. That is not a tooling inconvenience, it is a governance architecture problem. When access decisions, runtime actions and telemetry are split across systems, no single team can assert end-to-end control. The implication is that identity programmes must stop assuming the model is the governed unit; the governed unit is the execution path.

Single-pane visibility becomes a governance requirement once agents can act through multiple layers. ValidMind’s model is essentially an attempt to reassemble identity, observability and policy into one operational view. That is the right direction because agentic risk is rarely visible in one log stream. The field should treat this as evidence that visibility is now part of authorisation design, not a separate monitoring concern.

Policy enforcement without runtime correlation produces false confidence. A system can document constraints, enumerate use cases and still fail to show what actually happened during execution. That gap matters because agentic systems can cross a policy boundary while appearing compliant in isolated tools. The practitioner lesson is that governance evidence must be assembled from the runtime path, not inferred from documentation after the fact.

Skills and A2A proxies create identity diffusion unless ownership is explicit. The more intermediary components an agent uses, the easier it is for accountability to disappear into platform boundaries. That is why this space needs identity-bearing systems thinking, not just model management. Teams should assume every delegation layer can dilute control unless the identity model is explicit.

From our research library:

• According to PwC, 79% of organizations have already adopted AI agents to some degree.
• Read next: Agentic AI Identity Guide

What this signals

Identity-bearing systems need governance before consolidation, not after it. The market is already pushing agents, skills and MCP layers into production faster than most teams can unify their evidence model. That means the next control maturity jump is not another dashboard, but a programme that can connect identity, policy and runtime outcome across layers. Only 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.

Runtime correlation will matter more than static documentation. Agentic AI systems can look compliant on paper while still producing ungoverned behaviour in practice. Teams should expect audits to ask how decisions were captured, how actions were attributed and which system could interrupt execution. Unified governance graph: this is the emerging requirement for connecting policy, identity and telemetry into one traceable control view.

Programmes that keep observability and authorisation separate will struggle to prove control. The operational lesson is that agentic risk emerges at the seams between tools, not inside any one tool. If the governance record cannot follow the action from policy decision to downstream effect, the team does not have real control, only scattered evidence.

For practitioners

• Map the agent runtime path Document where the agent is hosted, where MCP policy is enforced, where observability is collected and which system can actually stop execution.
• Normalise telemetry across tool, policy and cost layers Create a common event model that joins agent identity, tool invocation, policy decision, cost signal and outcome in one record.
• Treat skills and A2A proxies as governed access surfaces Assign ownership, logging expectations and approval boundaries to every intermediary service that can expand an agent's effective capability.
• Define risk thresholds before production Set explicit escalation rules for hallucination, policy violation and unintended tool use so response is triggered before business impact spreads.

Key takeaways

• Agentic AI control depends on whether organisations can trace policy, identity and action across a fragmented runtime stack.
• The core evidence problem is not too little data but too little correlation between MCP decisions, agent actions and observability records.
• Practitioners should govern the execution path itself, because documentation without runtime correlation does not prove control.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Security Guide

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Unified Event Model: A normalised record that joins identity, action, policy decision, cost and outcome across multiple systems. It matters because agentic AI governance depends on correlating signals that are otherwise scattered across vendors, dashboards and runtime tools.
• A2A Proxy: An intermediary service that relays communication or requests between AI agents. It can expand the effective trust boundary by adding another place where authorisation, logging and accountability must be enforced and reviewed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.