Topic starter
18/08/2026 2:29 pm
TL;DR: Financial services firms are already deploying AI agents and MCP servers into production before governance catches up, creating audit, policy, and regulatory exposure, according to Stacklok. The core issue is that shared-service execution, shadow integrations, and runtime policy gaps break attributable identity and control assumptions before firms can scale safely.
Editorial analysis by NHI Mgmt Group, based on content published by Stacklok: “What financial services firms should demand from an AI control plane”.
Key questions
Q: What breaks when MCP governance is added after deployment?
A: Retrofitting control usually means unwinding over-broad credentials, rebuilding approval logic, and rediscovering where sensitive data can flow.
Q: Why do ungoverned AI control planes create regulatory risk in financial services?
A: Because the control plane sits between an AI action and a regulated business process.
Q: How do security teams know whether AI traffic controls are actually working?
A: They should look for evidence that policy decisions are consistent across prompts, responses, and tool calls, and that every block, mask, or alert can be traced back to a specific interaction.
Practitioner guidance
- Implement identity passthrough for every tool call Require OAuth token exchange, workload identity, or equivalent propagation so downstream systems can see the originating user or agent instead of a shared service principal.
- Enforce runtime policy changes without redeployment Insist on declarative, version-controlled policies that can be updated centrally when legal entities, MCP servers, or approval rules change.
- Make the approved AI path the easiest path Use a curated registry, self-service onboarding, and automatic configuration so developers do not create shadow integrations outside governance.
Bottom line: AI agents and MCP servers can enter production before governance catches up, which turns identity attribution and audit evidence into immediate control-plane concerns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:17 pm
AI control plane governance is now an identity governance problem, not just an infrastructure problem. When an MCP deployment touches customer data or regulated records, the main question is no longer whether the tooling works, but whether the firm can attribute action to the right user, agent, or workload. That moves the topic directly into IAM, NHI, and audit design. The practitioners who own identity need to treat the control plane as part of the access layer, not a separate orchestration concern.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: When should firms prioritise AI control plane governance over broader platform rollout?
A: Before production scale. If the firm already has regulated records, customer data, or multiple legal entities in scope, attribution and runtime policy have to come first because every week of delay increases the amount of shadow infrastructure that later has to be cleaned up.
👉 Read our full editorial: AI control plane governance gaps in financial services firms