Notifications
Clear all
Topic starter
18/08/2026 2:29 pm
TL;DR: Financial services firms are already deploying AI agents and MCP servers into production before governance catches up, creating audit, policy, and regulatory exposure, according to Stacklok. The core issue is that shared-service execution, shadow integrations, and runtime policy gaps break attributable identity and control assumptions before firms can scale safely.
NHIMG editorial — based on content published by Stacklok: AI Control Plane Buyer's Guide for Financial Services
By the numbers:
- One insurance conglomerate with 146 subsidiaries found MCP deployments spreading across business units with no policy in place.
- A cybersecurity firm with roughly 8,000 employees discovered distributed teams building agents independently, with almost no cross-team visibility.
Questions worth separating out
Q: How should teams govern AI agents that use MCP?
A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle.
Q: Why do shared service accounts create audit problems for AI control planes?
A: Shared service accounts collapse the link between action and actor.
Q: What do security teams get wrong about discoverability for MCP deployments?
A: They often treat discoverability as a catalogue problem instead of an adoption problem.
Practitioner guidance
- Map identity passthrough end to end Verify that every MCP tool call can be traced back to the initiating user or agent rather than a shared service principal.
- Require runtime policy enforcement Reject designs that depend on redeployment for policy changes.
- Instrument the sanctioned path first Build the curated registry, self-service onboarding, and telemetry export path so developers use the governed route by default.
What's in the full article
Stacklok's full blog post covers the operational detail this post intentionally leaves for the source:
- A six-section capability checklist for identity, governance, runtime security, observability, developer experience, and commercial considerations.
- Specific requirements such as OAuth token exchange, SPIFFE/SPIRE workload identity, per-server container isolation, and OpenTelemetry-native tracing.
- A sequencing guide that maps the biggest concern, such as audit readiness or developer adoption, to the right evaluation starting point.
- Market guidance on where lightweight gateways, developer-tooling platforms, and cloud provider offerings fall short in financial services.
👉 Read Stacklok's buyer's guide for AI control plane governance in financial services →
AI control plane governance for MCP deployments in financial services?
Explore further
18/08/2026 3:17 pm
AI control plane sprawl is an identity governance problem before it is a platform problem. The article shows that teams can deploy MCP servers and agents faster than policy can catch up, especially across subsidiaries and distributed development groups. That creates a governance gap in ownership, auditability, and enforcement that sits squarely inside IAM and IGA scope, not outside it. The practitioner conclusion is that platform selection only matters after the firm defines who is accountable for every agent action.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent accesses regulated data improperly?
A: Accountability sits with the teams that govern the agent's identity, the data classification, and the policy that allowed the access path. If those controls are disconnected, no single owner can explain why the access existed or why it was not removed sooner. Shared context is what makes accountability traceable.
👉 Read our full editorial: AI control plane governance gaps in financial services firms
