Topic starter
18/08/2026 2:16 pm
TL;DR: Agent security becomes fragile when enterprises split governance across an MCP gateway and an LLM gateway, because tool calls and model calls can be chained across two consoles without a shared identity, policy, or audit trail, according to Stacklok. The result is a cross-door gap that unified governance is designed to close.
Editorial analysis by NHI Mgmt Group, based on content published by Stacklok: “The two-door problem: splitting governance across an MCP gateway and an LLM gateway leaves a gap”.
Key questions
Q: What breaks when model and tool governance are split across two gateways?
A: The main failure is that no single control plane sees the full agent action.
Q: Why do separate AI and MCP gateways increase cross-door attack risk?
A: Because the attacker can place the malicious instruction on one side and trigger the consequence on the other.
Q: How can security teams tell whether shared account governance is failing?
A: Governance is failing when teams cannot answer who owns the account, who last used it, when it was rotated, and how quickly it is revoked after a user leaves.
Practitioner guidance
- Define one agent identity across both gateways Ensure the same principal, session, and policy context follows the agent through model calls and tool calls so audit records can be joined without manual reconciliation.
- Correlate tool results with downstream prompts Inspect the chain from inbound tool output to the next model request so injected instructions can be traced as a single path rather than two unrelated events.
- Collapse policy drift between control planes Keep the allowlists, content rules, and connector permissions aligned if separate products remain in use, because inconsistent rules create the seam attackers exploit.
Bottom line: Splitting agent governance across separate model and tool gateways creates a seam that attackers can exploit by moving malicious content from one door to the other.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:09 pm
Split governance creates a cross-door identity gap: an agent does not behave like two separate systems just because two vendors watch it. When model calls and tool calls are governed in different places, the policy boundary no longer matches the action boundary. The result is not merely inconsistent logging, but a broken trust model for agent identity across the full execution path. Practitioners should treat the seam itself as the control problem.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When is one control plane preferable to separate agent gateways?
A: Use one control plane when agents both call models and invoke tools, or when auditability and incident reconstruction matter. A unified policy layer gives a single identity, a single rule set, and one timeline for model and tool activity. That is the cleaner operating model for agentic AI governance.
👉 Read our full editorial: Split governance leaves a seam in agent security control