Topic starter
18/08/2026 2:29 pm
TL;DR: Financial services firms are deploying AI agents and MCP servers before governance catches up, according to Stacklok. Runtime policy, identity passthrough, and audit evidence have to be in place before scale turns shadow integrations into control gaps.
Editorial analysis by NHI Mgmt Group, based on content published by Stacklok: “What financial services firms should demand from an AI control plane”.
Key questions
Q: Why do ungoverned AI control planes create regulatory risk in financial services?
A: Because the control plane sits between an AI action and a regulated business process.
Q: How do security teams know whether AI traffic controls are actually working?
A: They should look for evidence that policy decisions are consistent across prompts, responses, and tool calls, and that every block, mask, or alert can be traced back to a specific interaction.
Q: What breaks when MCP governance is added after deployment?
A: Retrofitting control usually means unwinding over-broad credentials, rebuilding approval logic, and rediscovering where sensitive data can flow.
Practitioner guidance
- Implement identity passthrough for every tool call Require OAuth token exchange, workload identity, or equivalent propagation so downstream systems can see the originating user or agent instead of a shared service principal.
- Enforce runtime policy changes without redeployment Insist on declarative, version-controlled policies that can be updated centrally when legal entities, MCP servers, or approval rules change.
- Make the approved AI path the easiest path Use a curated registry, self-service onboarding, and automatic configuration so developers do not create shadow integrations outside governance.
Bottom line: AI agents and MCP servers can enter production before governance catches up, which turns identity attribution and audit evidence into immediate control-plane concerns.
Glossary terms: Atlas Control Plane, Identity Passthrough, Shadow Integration, Runtime Policy Enforcement
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
18/08/2026 3:17 pm
AI control plane governance is now an identity governance problem, not just an infrastructure problem. When an MCP deployment touches customer data or regulated records, the main question is no longer whether the tooling works, but whether the firm can attribute action to the right user, agent, or workload. That moves the topic directly into IAM, NHI, and audit design. The practitioners who own identity need to treat the control plane as part of the access layer, not a separate orchestration concern.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: When should firms prioritise AI control plane governance over broader platform rollout?
A: Before production scale. If the firm already has regulated records, customer data, or multiple legal entities in scope, attribution and runtime policy have to come first because every week of delay increases the amount of shadow infrastructure that later has to be cleaned up.
👉 Read our full editorial: Production AI in financial services needs runtime governance first
This post was modified 17 hours ago by NHI Mgmt Group