Notifications
Clear all
Topic starter
18/08/2026 2:16 pm
TL;DR: Agent security becomes fragile when enterprises split governance across an MCP gateway and an LLM gateway, because tool calls and model calls can be chained across two consoles without a shared identity, policy, or audit trail, according to Stacklok. The result is a cross-door gap that unified governance is designed to close.
NHIMG editorial — based on content published by Stacklok: The two-door problem, splitting governance across an MCP gateway and an LLM gateway leaves a gap
Questions worth separating out
Q: How should teams govern agents that use both model calls and tool calls?
A: Treat the full workflow as one identity problem, not two separate control problems.
Q: What breaks when MCP and LLM governance are split across different vendors?
A: The seam becomes the failure point.
Q: When does split governance become too risky for agentic systems?
A: It becomes too risky when the agent both consumes tool output and generates model output that can influence further action.
Practitioner guidance
- Inventory the two doors in every agent workflow Document which agents call models, which invoke tools, and which do both.
- Correlate model and tool telemetry in one trail Ensure the same agent identity, session context, and policy decision are visible in both logs before they reach the SIEM.
- Test for seam exploitation with prompt injection drills Run exercises that begin with a malicious tool result and end with a model-driven exfiltration attempt.
What's in the full article
Stacklok's full blog post covers the operational detail this post intentionally leaves for the source:
- A fuller walkthrough of how the MCP gateway and AI gateway map to separate control points in an agent workflow
- The vendor's explanation of when split governance may still be acceptable for limited deployments
- Operational detail on how unified governance is implemented in Stacklok's control plane
- The source article's own framing of which enterprise conditions make cross-door risk most urgent
👉 Read Stacklok's analysis of the two-door problem in agent governance →
MCP gateway and AI gateway splits: what gap are teams missing?
Explore further
18/08/2026 3:09 pm
Split governance is a visibility problem before it is a policy problem. When one product watches model calls and another watches tool calls, neither control plane sees the complete agent action. That means the most dangerous behaviour is not necessarily blocked, but simply fragmented across logs, consoles, and policy languages. The practical conclusion is that cross-door visibility is the minimum viable condition for agent governance.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, which shows that governance maturity is moving from awareness to budgeted action.
A question worth separating out:
Q: Who is accountable when a cross-door agent attack slips through separate controls?
A: Accountability sits with the teams that allowed the workflow to span two governance domains without a unified control plane. The issue is not only malicious behaviour, but the architecture that made attribution difficult. Security, identity, and platform owners all need a shared answer for the same agent trail.
👉 Read our full editorial: Split governance leaves a seam in agent security control
