TL;DR: Most security teams still cannot answer where AI is running, what data it touches, or whether current controls can govern it, according to TruFoundry's analysis. That gap matters because shadow AI and agentic usage turn visibility, identity, and auditability into the deciding controls, not just another proxy layer.
At a glance
What this is: This analysis argues that an AI gateway is only useful if it can see, govern, and audit AI usage across sanctioned and unsanctioned paths.
Why it matters: It matters because IAM, NHI, and security teams need a control point that can distinguish identity, enforce scope, and preserve evidence across shadow AI and agent traffic.
By the numbers:
- 20% of breached organizations were compromised through shadow AI, adding roughly $670,000 to the average breach cost, according to IBM’s 2025 Cost of a Data Breach Report cited by TruFoundry.
- 97% lacked proper access controls among organizations compromised through shadow AI, according to IBM’s 2025 Cost of a Data Breach Report cited by TruFoundry.
- 63% had no AI governance policy at all in a Ponemon Institute survey of 600 organizations cited by TruFoundry.
Context
Most AI gateway conversations start with the wrong unit of analysis. The real problem is not whether traffic is proxied, but whether security teams can inventory AI usage, bind it to identity, and keep an auditable record of what happened across sanctioned tools, browser access, desktop apps, and embedded AI.
For IAM and NHI programmes, that makes the gateway a governance boundary rather than a simple network control. The article’s core point is that visibility alone is incomplete unless it connects to access management, privilege scope, and logging that can survive shadow AI and agent-driven workflows.
Key questions
A: Teams should inventory AI tools and agents, then correlate sign-up emails, OAuth grants, identity events, and platform telemetry to understand what is in use and what data it can reach. Governance should separate approved use from shadow AI, track risky access, and enforce controls when tools or agents behave outside expected patterns.
Q: Why do AI gateways need identity and token exchange controls?
A: AI gateways need identity controls because raw secrets do not preserve accountability in multi-step agent workflows. Token exchange lets the organisation keep the human as the accountable subject while assigning each acting agent a scoped, revocable credential. That prevents delegated activity from disappearing behind one shared token.
Q: What are the signs that AI gateway logging is not enough for governance?
A: If logs show traffic volume but cannot tie each request to a person, device, or access decision, they are operational telemetry rather than audit evidence. Governance breaks when a security team can see usage but cannot explain or review the permissioning behind it.
Q: What should teams do when AI usage lives inside SaaS features they cannot intercept?
A: When AI is embedded in SaaS features, teams should treat the vendor’s admin settings and surrounding controls as the enforcement surface. There may be no gateway path to intercept, so the organisation needs fallback governance such as CASB-style controls, vendor policy settings, and tighter review of data exposure.
Technical breakdown
AI gateway visibility across sanctioned and shadow AI
An AI gateway can only govern what it can observe, which is why the path into the gateway matters as much as the gateway itself. The article distinguishes between developer-built apps, desktop and CLI tools, consumer web apps, and AI embedded inside SaaS. Each path has a different enforcement model, from endpoint configuration to on-device interception to cases where no gateway control exists at all. That makes inventory and routing architecture the first technical question, not a later compliance task.
Practical implication: map every AI entry path before selecting controls, or you will overestimate what the gateway can actually govern.
Identity and token exchange for AI agents
The article’s most important identity point is that AI agents need a distinct identity model, not just a shared API key. For agent chains, token exchange preserves the human as the accountable subject while giving each acting agent a fresh scoped token. That reduces identity collapse in delegated workflows and makes later audit meaningful. In NHI terms, the gateway is not only authenticating calls, it is binding actions to the right executor and narrowing scope hop by hop.
Practical implication: treat agent identity as first-class and require scoped, revocable credentials for each execution hop.
MCP governance and audit trail enforcement
The article treats MCP as a high-blast-radius channel because tool calls can write to databases, send emails, or trigger other actions. Gateway controls therefore need to separate inbound authentication, server and tool authorisation, and outbound authentication to the MCP server. The logging requirement is equally specific: prompt, response, identity, and cost need to be captured in a way that supports forensic reconstruction and compliance evidence. Without that, the gateway becomes a traffic observer, not a governance control.
Practical implication: enforce tool-level authorisation and immutable logs for each MCP call, not just session-level visibility.
Threat narrative
Attacker objective: The objective is to use unmanaged AI access paths to reach data, tools, or workflows that the security programme cannot reliably see or govern.
- Entry occurs when employees or developers use shadow AI tools or agent frameworks that security teams have not approved or inventoried.
- Credential and access scope are then distributed across raw API keys, browser traffic, or delegated agent tokens, making governance dependent on whichever path the user chose.
- Impact follows when ungoverned AI use touches internal tools, sensitive data, or MCP actions without a complete audit trail or access control boundary.
Breaches seen in the wild
- LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI gateway governance fails when visibility is treated as the finish line. TruFoundry’s analysis shows that seeing AI traffic is only useful if it can be tied to identity, scope, and evidence. A gateway that cannot distinguish approved from shadow use, or preserve the audit record of who acted, is not governing AI usage. Practitioners should treat inventory, identity binding, and logging as one control plane, not three separate projects.
Scoped identity, not shared secrets, is the real control boundary for AI agents. Raw API keys let agent workflows blur who acted, on whose behalf, and with what authority. The more an organisation uses planning agents, retrieval agents, and MCP tools, the more it needs token exchange and revocable agent identity to keep accountability intact. That is an NHI governance problem with direct implications for AI operations.
AI gateways are becoming the policy junction between endpoint controls, SWG controls, and application-layer governance. The article makes clear that a gateway must fit around the stack already in place, not replace it. That means security teams should expect enforcement to be distributed across MDM, endpoint blocking, SaaS admin settings, SWG routing, and gateway policy. The architectural question is no longer whether to add a gateway, but where it belongs in the control chain.
Shadow AI turns auditability into a containment requirement, not just a compliance feature. If the organisation cannot reconstruct prompt, response, identity, and cost from a single log stream, then AI use cannot be reliably investigated or governed after the fact. The practical implication is that logging design has to be good enough for forensics before it is good enough for reporting.
AI gateway programmes now have to bridge human IAM and NHI governance. The article’s most durable insight is that human users, desktop tools, consumer apps, embedded SaaS features, and autonomous or semi-autonomous agents all behave differently at the identity layer. A usable governance model has to recognise that difference instead of flattening every AI interaction into one proxy control.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
AI gateway programmes should be judged by how much of the identity problem they remove, not how much traffic they can inspect. If the gateway cannot convert AI use into scoped, revocable identities and evidentiary logs, the programme still lacks the controls needed for governance. That is why visibility, authorisation, and auditability have to be designed together rather than layered later.
Shadow AI discovery and agent identity management now move together. As AI usage spreads through consumer tools, desktop clients, and embedded SaaS, security teams need discovery mechanisms that find the tool and identity controls that constrain it. AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
For practitioners
- Inventory every AI entry path Classify developer-built apps, desktop and CLI tools, consumer web apps, and embedded SaaS AI separately so you know where gateway controls can and cannot apply.
- Bind agent actions to scoped identities Require a distinct identity for each agent and use token exchange or equivalent delegation controls so the human subject and the acting agent remain distinguishable.
- Separate gateway policy from raw secret handling Replace shared API keys with revocable, application-scoped credentials wherever the gateway can issue or broker them, especially for internal tool calls and MCP traffic.
- Preserve forensic-grade logging Capture prompt, response, identity, and cost in a log stream that can feed both investigation and SIEM export without breaking the chain of evidence.
- Keep the gateway inside the existing stack Route AI-bound traffic from SWG, MDM, and endpoint controls into the gateway instead of treating it as a replacement for those layers.
Key takeaways
- AI gateway value comes from governance, not interception alone, because the central issue is whether the organisation can bind AI activity to identity and policy.
- Shadow AI and agent workflows create control gaps when security teams cannot inventory usage or preserve a defensible audit trail.
- The practical response is to align discovery, token scope, and logging so that AI traffic can be governed across endpoint, gateway, and SaaS paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | The article centers on sanctioned and shadow AI use by humans through machine identities and shared secrets. |
| NHI-04 — Insecure Authentication | Gateway access and agent delegation depend on how identities authenticate and are bound to actions. | |
| NHI-05 — Overprivileged NHI | The article stresses scoped credentials and least privilege for agents and gateway-managed access. | |
| Recommendation — Separate human-triggered AI use from machine credentials and revoke any shared access paths. Use strong authentication and per-identity binding for AI gateways and agent callers. Reduce gateway-issued permissions to the minimum scope needed for each AI workflow. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent chains and delegated access are central to the article’s governance concerns. |
| Recommendation — Constrain agent privileges and trace every delegated hop to its accountable subject. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on governed access, scoped roles, and who can reach AI tools and servers. |
| Recommendation — Review AI access permissions continuously and remove broad entitlements from gateway paths. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | Shadow AI and leaked credentials create paths to sensitive data and downstream exfiltration. |
| Recommendation — Map AI gateway gaps to credential access and exfiltration detections in your monitoring stack. | ||
Key terms
- AI Gateway: A control point that sits between AI applications and the models, tools, or data they call. In practice, it can authenticate requests, enforce policy, inspect runtime behaviour, and stop unsafe actions before they spread into connected systems.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Token Exchange: Token exchange is an OAuth pattern that swaps one credential or token for another with narrower scope or different trust context. In NHI governance, it is useful when a workload must cross boundaries without carrying broad, reusable privileges into downstream systems.
- MCP Gateway: The control layer that relays assistant intent to tools and data sources through the Model Context Protocol. In practice, it becomes a policy boundary, not just a transport layer. If it trusts model output too early, it can turn unverified reasoning into real-world execution or disclosure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org