Split governance leaves a seam in agent security control

At a glance

What this is: This is Stacklok’s analysis of why agent security breaks when MCP and model governance are split across separate gateways, leaving a cross-door seam that hides prompt injection and exfiltration chains.

Why it matters: IAM, NHI, and agentic AI teams need a shared view of identity, policy, and audit across both model calls and tool calls or they inherit blind spots between control planes.

Context

Agent security depends on governing two distinct exits: the model path and the tool path. In this article, the problem is not the existence of gateways, but the split between them, which creates a seam where policy, identity, and logging no longer line up.

For teams building agentic AI programmes, that seam becomes an identity governance issue as soon as the same agent can both consume model output and invoke tools. The question is whether one control plane can see the full action, or whether each gateway only sees half the behaviour.

Key questions

Q: What breaks when model and tool governance are split across two gateways?

A: The main failure is that no single control plane sees the full agent action. Tool calls and model calls can each look normal in isolation while the malicious sequence crosses the seam between them. That breaks correlation, weakens accountability, and leaves prompt injection or exfiltration visible only in fragments.

Q: Why do separate AI and MCP gateways increase cross-door attack risk?

A: Because the attacker can place the malicious instruction on one side and trigger the consequence on the other. Each gateway enforces policy only on its own traffic, so the combined path is not evaluated as one security decision. The risk rises whenever agents both consume model output and invoke tools.

Q: How can security teams tell whether shared account governance is failing?

A: Governance is failing when teams cannot answer who owns the account, who last used it, when it was rotated, and how quickly it is revoked after a user leaves. Those gaps show that the account is being treated as a convenience login rather than a governed identity with lifecycle controls.

Q: When is one control plane preferable to separate agent gateways?

A: Use one control plane when agents both call models and invoke tools, or when auditability and incident reconstruction matter. A unified policy layer gives a single identity, a single rule set, and one timeline for model and tool activity. That is the cleaner operating model for agentic AI governance.

Technical breakdown

Why separate AI and MCP gateways create a control seam

An AI gateway governs model calls, while an MCP gateway governs tool calls through the Model Context Protocol. When those controls sit in different products, each enforces policy on only one leg of the agent’s behaviour. That matters because many agent attacks are not single-event failures. A malicious instruction can enter through a tool result, then trigger data exfiltration through a model call, or vice versa. Each gateway sees normal traffic on its own side, but neither sees the complete sequence. The architectural issue is not just duplicated tooling. It is that the security boundary is split across two consoles, two policy models, and two audit trails.

Practical implication: Treat model and tool governance as one control domain, not two independent products.

How cross-door prompt injection evades split governance

Prompt injection becomes harder to detect when the malicious instruction is delivered through one door and executed through the other. The MCP gateway may see a well-formed tool response, while the AI gateway only sees a prompt that appears legitimate after the agent has already consumed the poisoned content. The reverse pattern also matters: sensitive context can be introduced in a model response and then leaked out through a tool call. The core failure is correlation. Without a single policy plane that sees both legs, the defender cannot reconstruct intent, sequence, or origin across the agent workflow.

Practical implication: Correlate tool and model events in one policy and logging pipeline before you rely on the telemetry.

Why identity consistency matters across agent actions

Split governance often means split identity resolution. One gateway may attribute the model call to one principal, while the other attributes the tool action differently or not with enough fidelity to correlate. That breaks accountability because the agent’s full action no longer resolves to one stable identity across the workflow. For IAM and NHI teams, this is not a convenience issue. It means entitlement, access scope, and audit evidence no longer compose cleanly across the action path. When identity changes by door, governance changes by door too.

Practical implication: Use one identity model for every agent action so audit, access scope, and accountability stay aligned.

Threat narrative

Attacker objective: The attacker wants to use one gateway as the blind spot for the other, then move data or instructions across the seam without a single control plane detecting the full chain.

1. Entry occurs when a malicious instruction arrives through a tool result or a model response that looks normal to the first gateway.
2. Credential or context abuse follows when the agent uses that poisoned input to continue across the second gateway without a shared trust decision.
3. Impact occurs when the agent exfiltrates data or leaks sensitive context through the door that did not see the original compromise path.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Split governance creates a cross-door identity gap: an agent does not behave like two separate systems just because two vendors watch it. When model calls and tool calls are governed in different places, the policy boundary no longer matches the action boundary. The result is not merely inconsistent logging, but a broken trust model for agent identity across the full execution path. Practitioners should treat the seam itself as the control problem.

Cross-door attacks exploit the fact that each gateway sees a partial truth: one side receives the injected instruction, the other side receives the consequence. That means prompt injection, data exfiltration, and context leakage become sequence problems, not isolated events. A governance model that cannot preserve sequence across doors cannot reliably explain agent behaviour after the fact. The implication is that correlation is a governance control, not a reporting convenience.

Identity must be stable across model and tool use: if the same agent resolves to different principals at different doors, accountability collapses into vendor-specific logs. That is a lifecycle and audit failure, not a tooling preference. NHI and IAM teams need a single interpretation of the actor, the policy, and the evidence trail across both paths. The practitioner conclusion is simple: if identity is not consistent, control is not consistent.

Hallway governance is now a named concept: the space between an AI gateway and an MCP gateway behaves like a separate attack surface, even when each product is individually well managed. This hallway is where policy drift, identity drift, and audit drift accumulate because neither control plane owns the full sequence. The implication for the field is that agent security architecture must be evaluated at the path level, not just the product level.

Unified governance changes the category, not just the deployment: once the same control plane enforces policy across model and tool exits, the governance question moves from detection to decision authority. That is why split stacks increasingly look like temporary scaffolding rather than a durable operating model for agentic AI. Practitioners should plan for consolidated oversight wherever agents can both think and act.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Hallway governance: the seam between an AI gateway and an MCP gateway now behaves like its own attack surface. If your programme only measures model access or only measures tool access, you are governing half the agent and leaving the sequence unowned.

Access review cadences and gateway logs do not solve a split-control problem by themselves. What matters is whether the same identity, policy, and evidence trail follow the agent from prompt to tool use and back again.

Teams should expect agent governance to consolidate around control planes that can see both exits, because cross-door correlation is becoming a baseline requirement rather than an optional hardening step.

For practitioners

• Define one agent identity across both gateways Ensure the same principal, session, and policy context follows the agent through model calls and tool calls so audit records can be joined without manual reconciliation.
• Correlate tool results with downstream prompts Inspect the chain from inbound tool output to the next model request so injected instructions can be traced as a single path rather than two unrelated events.
• Collapse policy drift between control planes Keep the allowlists, content rules, and connector permissions aligned if separate products remain in use, because inconsistent rules create the seam attackers exploit.
• Review whether split governance is still acceptable Re-evaluate point solutions once agents both call models and invoke tools, especially where auditability, compliance evidence, or prompt injection resistance matter.

Key takeaways

• Splitting agent governance across separate model and tool gateways creates a seam that attackers can exploit by moving malicious content from one door to the other.
• The operational risk is not theoretical. The same workflow can appear clean in each gateway while the combined path hides prompt injection, exfiltration, or identity drift.
• Practitioners should judge agent controls by whether they preserve one identity, one policy view, and one audit trail across both model calls and tool calls.

Key terms

• Agent gateway: The local or remote control layer that authenticates, pairs, and orchestrates an AI agent’s actions across connected tools. In practice it becomes an identity concentrator, because one gateway session can govern messages, commands, and downstream systems with far broader reach than the user interface suggests.
• Cross-door attack: An attack pattern where malicious behaviour enters through one governance layer and exits through another, so neither control plane sees the full sequence. The risk is greatest when identity, policy, and telemetry are split across separate products or teams.
• Gateway Seam: A gateway seam is the gap between two separately governed control planes where policy, identity, and logging no longer line up. In agent security, seams become attack surfaces whenever model and tool traffic are assessed independently.
• Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.