Topic starter
19/08/2026 3:30 pm
TL;DR: Shadow AI and agent workflows still leave security teams without a defensible audit trail, TruFoundry reports, even when AI gateway traffic is visible. Governance depends on identity binding and logging that can prove who acted, what data was touched, and under what policy.
Editorial analysis by NHI Mgmt Group, based on content published by TruFoundry: “What security teams actually need from an AI gateway?”.
By the numbers:
- 20% of breached organizations were compromised through shadow AI, adding roughly $670,000 to the average breach cost, according to IBM’s 2025 Cost of a Data Breach Report cited by TruFoundry.
- 97% lacked proper access controls among organizations compromised through shadow AI, according to IBM’s 2025 Cost of a Data Breach Report cited by TruFoundry.
- 63% had no AI governance policy at all in a Ponemon Institute survey of 600 organizations cited by TruFoundry.
Key questions
Q: Why do AI gateways need identity and token exchange controls?
A: AI gateways need identity controls because raw secrets do not preserve accountability in multi-step agent workflows.
Q: What are the signs that AI gateway logging is not enough for governance?
A: If logs show traffic volume but cannot tie each request to a person, device, or access decision, they are operational telemetry rather than audit evidence.
A: Teams should inventory AI tools and agents, then correlate sign-up emails, OAuth grants, identity events, and platform telemetry to understand what is in use and what data it can reach.
Practitioner guidance
- Inventory every AI entry path Classify developer-built apps, desktop and CLI tools, consumer web apps, and embedded SaaS AI separately so you know where gateway controls can and cannot apply.
- Bind agent actions to scoped identities Require a distinct identity for each agent and use token exchange or equivalent delegation controls so the human subject and the acting agent remain distinguishable.
- Separate gateway policy from raw secret handling Replace shared API keys with revocable, application-scoped credentials wherever the gateway can issue or broker them, especially for internal tool calls and MCP traffic.
Bottom line: AI gateway value comes from governance, not interception alone, because the central issue is whether the organisation can bind AI activity to identity and policy.
Glossary terms: AI Gateway, Shadow AI, Token Exchange, MCP Gateway
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 20 hours ago by NHI Mgmt Group
19/08/2026 4:13 pm
AI gateway governance fails when visibility is treated as the finish line. TruFoundry’s analysis shows that seeing AI traffic is only useful if it can be tied to identity, scope, and evidence. A gateway that cannot distinguish approved from shadow use, or preserve the audit record of who acted, is not governing AI usage. Practitioners should treat inventory, identity binding, and logging as one control plane, not three separate projects.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams do when AI usage lives inside SaaS features they cannot intercept?
A: When AI is embedded in SaaS features, teams should treat the vendor’s admin settings and surrounding controls as the enforcement surface. There may be no gateway path to intercept, so the organisation needs fallback governance such as CASB-style controls, vendor policy settings, and tighter review of data exposure.
👉 Read our full editorial: AI gateways only matter when they bind usage to identity
This post was modified 20 hours ago by NHI Mgmt Group