AI gateways: what control plane governance changes for IAM teams

TL;DR: AI gateways are becoming commodity infrastructure, but routing and logging alone cannot govern agentic systems because approved agents can still take unintended actions faster than humans can review them, according to JetStream Security research. The control problem shifts from request handling to runtime authorisation, approved design enforcement, and action-level policy.

Editorial analysis by NHI Mgmt Group, based on content published by JetStream Security: “An AI Gateway Is Insufficient Security Without a Control Plane”.

Key questions

Q: What breaks when an AI gateway lacks enterprise governance features?

A: Without enterprise governance, teams often lose auditability, enforceable access control, and consistent policy enforcement.

Q: Why do agentic systems need runtime authorisation instead of static permissions?

A: Static permissions describe what an agent can generally reach, but runtime authorisation decides whether that specific action, at that specific moment, is acceptable.

Q: How should teams govern MCP tools that expose both safe and destructive actions?

A: They should treat the tool surface as a privilege boundary and authorise specific functions, not the whole connector.

Practitioner guidance

• Define the control plane boundary Separate transport handling, identity proofing, approved design validation, and action authorisation so each control has a distinct enforcement point.
• Inventory every agentic integration path Map which agents, MCP servers, datasets, and cloud services can execute without human approval, then identify where policy is only logged rather than enforced.
• Bind policy to the action, not only the session Set controls at tool and parameter level so a permitted read action cannot implicitly grant delete, write, or exfiltration capability.

Bottom line: AI gateway adoption does not remove the need for runtime authorisation, because authenticated agent requests can still execute unsafe actions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →