TL;DR: As MCP becomes the default tool-calling layer for agents, organisations need gateways that can enforce tool-level policy, short-lived identity assertions, session-aware controls, and auditable decisions. Pomerium’s analysis argues that traditional API gateways miss the semantic and governance gaps that agentic workflows create.
At a glance
What this is: This is a comparative analysis of agentic gateways for MCP tool calls, arguing that security now depends on tool-level policy, session awareness, short-lived identity assertions, and auditable decisions rather than generic API controls.
Why it matters: IAM, PAM, and NHI teams need to reassess how they authorize agent-driven access because MCP changes the unit of control from endpoints to actions inside a workflow.
By the numbers:
- 1,862 internet-exposed MCP servers with zero authentication show how quickly agentic infrastructure can outpace baseline access controls.
Context
MCP tool-call security is now an access-governance problem, not just a transport problem. Once agents can invoke external tools over JSON-RPC, the control question shifts to what they may call, what parameters they may pass, and how those decisions are recorded.
Traditional API gateways were built for human-initiated requests and service-to-service traffic. That model breaks down when workflow context, delegated action, and semantic authorisation all matter at the same time.
This article frames agentic gateways as the missing policy layer for MCP deployments. The issue is not whether an agent can reach a server, but whether identity, intent, and auditability remain intact across multi-step tool use.
Key questions
Q: What breaks when MCP is governed only as generic API traffic?
A: You lose tool-level control, workflow context, and meaningful audit evidence. Generic API gateways can authenticate and rate limit, but they usually cannot distinguish between safe and unsafe methods inside the same MCP server or track how one tool call changes the next. That creates over-permissioning and weak accountability.
Q: Why do short-lived assertions matter for agentic tool access?
A: They reduce the value of stolen credentials and align access with a specific request or session instead of a reusable secret. When an agent is compromised, the attacker should not inherit a long-lived token that can be replayed later. Short-lived assertions shift the trust boundary to controlled, expiring identity evidence.
Q: How do you know if an MCP gateway is actually enforcing policy?
A: Check whether it can produce an auditable decision trail that includes the agent, tool, method, parameters, and allow or deny outcome. If logs only show traffic volume or request status, the gateway is not proving that policy was enforced at the level where agent risk exists. The evidence must match the decision point.
Q: When should teams choose a session-aware gateway over standard API management?
A: Use session-aware controls when an agent makes multi-step decisions and the safety of later calls depends on earlier approvals or workflow state. Standard API management is often enough for static request patterns. It is not enough when authorisation must follow the sequence of an autonomous or semi-autonomous task.
Technical breakdown
Why MCP breaks generic API gateway assumptions
MCP is not just another API pattern. It exposes servers, tools, methods, and parameters in a way that makes authorisation more granular than server-level allow or deny. Generic gateways can authenticate requests and rate limit traffic, but they usually do not understand whether an agent is allowed to call customer.fetch while being blocked from customer.delete. That difference matters because the security decision is about tool semantics, not only network access. In agentic workflows, each call may change the next available action, which means policy must follow the session, not just the request.
Practical implication: evaluate whether your gateway can enforce tool-level policy rather than only server-level access.
How short-lived assertions reduce agent credential exposure
The article highlights a core pattern for non-human identity governance in agentic systems: the agent should not hold long-lived secrets. Instead, the gateway can inject short-lived, cryptographically signed identity assertions that the MCP server validates for signature and expiration. This shifts trust from static credentials to time-bound assertions bound to the request path. If an agent process is compromised, the blast radius is smaller because there is no reusable secret to steal and replay. That design aligns with zero standing privilege thinking, but it is applied to agent tool calls rather than human sessions.
Practical implication: prefer gateways that abstract credentials away from the agent and replace them with short-lived assertions.
Why session-aware authorisation is the real differentiator
Agentic workflows are sequential. A policy that works for a single request can fail when the next tool call depends on what happened in the previous step. Session-aware enforcement lets the gateway evaluate context, such as whether a user approved a transaction before the agent calls payment.process. Without that memory, security teams either over-permit every call or block legitimate multi-step work. The governance gap is not visibility alone. It is the inability to make an authorisation decision that understands the workflow state in which the call occurs.
Practical implication: require policy engines that can evaluate multi-step context, not just isolated requests.
Breaches seen in the wild
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Tool-level authorisation has become the control boundary for agentic identity. MCP moves the governance question from who can reach a server to what an agent can do inside that server. That is a different control plane, and teams that keep treating MCP like generic API traffic will miss the real privilege boundary. The practical conclusion is that access policy must be written at the level of tools and methods, not only endpoints.
Long-lived credentials are the wrong trust primitive for agentic workflows. The article’s emphasis on short-lived identity assertions reflects a broader NHI rule: if the agent can act autonomously across steps, reusable secrets create avoidable exposure. The identity problem is not just authentication at entry, but how identity is carried safely across the workflow. Practitioners should treat credential abstraction as a governance requirement, not an implementation detail.
Session awareness is now a governance assumption, not an optional enhancement. Traditional access models assume each request can be judged in isolation. MCP-driven tool chains invalidate that assumption because the safety of a later call depends on what happened earlier in the session. The implication is that authorisation for agentic systems must be evaluated as a stateful process, not a stateless transaction.
Audit logs must capture semantic intent, not just network events. Recording that a request occurred is not enough when the security question is whether the right agent invoked the right tool with the right parameters for the right reason. Semantic logging becomes the evidence layer for accountability in regulated environments. Organisations that need defensible review trails should treat tool, method, parameter, and decision logging as the minimum viable record.
Identity-aware gateways are becoming the practical control point for MCP governance. The market is converging on a layer that sits between agents and tools because neither traditional IAM nor generic API management can fully answer the new question. That signals a shift toward policy enforcement at the interaction layer. Teams should expect their identity programme to absorb more runtime policy responsibility as agentic adoption grows.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Tool-level policy will become the default control plane for agentic access. As MCP adoption grows, teams will need to move authorisation decisions from coarse API gateways into controls that understand tools, methods, and workflow state. That change affects IAM, PAM, and NHI governance at the same time because the identity boundary is now inside the session.
Credential abstraction is the line between manageable and fragile agent design. If agents still hold reusable secrets, compromise becomes a replay problem. If they receive short-lived identity assertions, governance can focus on issuance, scope, and expiry rather than secret recovery.
The 1,862 internet-exposed MCP servers with zero authentication, according to the State of Secrets Sprawl 2026, show that the attack surface is already visible before many organisations have formalised their gateway strategy.
For practitioners
- Define tool-level entitlements Map every MCP server method to an explicit allow or deny decision, and do not rely on server-wide access as a proxy for least privilege.
- Replace reusable agent secrets Move agents to short-lived identity assertions or equivalent ephemeral credentials so a compromised process cannot replay a standing secret.
- Make policy session-aware Require the gateway to evaluate prior steps, user approval state, and workflow context before allowing sensitive follow-on tool calls.
- Log semantic authorisation decisions Capture agent identity, tool name, method, parameters, response status, and the allow or deny rationale in a reviewable audit trail.
- Test prompt-injection handling at the tool layer Validate whether the gateway can inspect tool responses for embedded instructions or suspicious structures before they reach the agent.
Key takeaways
- MCP changes the security unit from server access to tool-level action control, which generic API gateways do not reliably provide.
- Short-lived identity assertions and session-aware policy are the two controls that most directly reduce agentic exposure and improve governance.
- Auditable decisions that capture tool, method, parameters, and rationale are now essential evidence for identity and access reviews.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | MCP gateways here replace weak agent authentication with short-lived assertions. |
| NHI-05 — Overprivileged NHI | Tool-level allow lists address agents that can call more tools than they need. | |
| NHI-07 — Long-Lived Secrets | The article explicitly warns against agents holding long-lived credentials. | |
| Recommendation — Use NHI-04 to replace reusable agent secrets with expiring authentication evidence. Apply NHI-05 to constrain each agent to the minimum tools and methods required. Use NHI-07 to eliminate standing credentials from agent-to-tool flows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about entitlements at the tool and method level. |
| DE.CM-01 — Networks and Network Services Monitored to Find Potentially Adverse Events | Comprehensive logging and contextual audit evidence are central to gateway selection. | |
| Recommendation — Apply PR.AA-05 to govern agent entitlements at the method level rather than the server level. Monitor MCP traffic and authorisation decisions so anomalous tool use is visible for review. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic tool calls can overreach unless identity and privilege are constrained in-session. |
| Recommendation — Use ASI03 to restrict agent privilege when tool access expands across workflow steps. | ||
Key terms
- Agentic Gateway: An agentic gateway is a policy enforcement layer placed between AI agents and the tools they call. It evaluates identity, scope, and context before allowing access, then records the decision. In practice, it turns agent execution into something security teams can govern rather than merely observe.
- Tool-level Authorization: Tool-level authorization is the practice of checking permissions on each discrete action a client asks an MCP server to perform. It matters because LLMs can generate dynamic requests, so access control must be enforced where the action is executed, not only where the request is formed.
- Identity Assertion: Identity assertion is evidence used to state that an actor is acting on behalf of a particular user or principal. For agents, this can come from a trusted provider or from a claim ceremony, and the strength of that assertion determines how much access the service should grant.
- Session-Aware Policy: Session-aware policy evaluates access decisions using the state of an entire workflow, not just one request. In agentic environments, this is essential because a tool call may be safe only in the context of prior approval, prior input, or the current task boundary.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 9, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org