Topic starter
02/08/2026 11:48 am
TL;DR: AI agents operate across a three-layer agentic stack of LLM, MCP server, and APIs, and Salt argues that security risk propagates through all three layers even when the model itself appears safe. The governance gap is that conventional perimeter and model-only controls do not cover autonomous API execution or tool access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “The Agentic Stack Explained: How LLMs, MCP Servers, and APIs Work Together”.
Key questions
Q: What breaks when an AI agent is allowed to call tools without strict scope controls?
A: The main failure is privilege expansion.
Q: Why do enterprise chatbots create more risk than consumer chatbots?
A: Enterprise chatbots are connected to systems of record and often operate with organisational authority.
Q: How do I know if an agentic security workflow is actually safe?
A: Look for reproducibility, deterministic policy checks, and complete audit trails.
Practitioner guidance
- Map the full agentic chain Create an inventory of every AI agent, MCP server and API it can invoke, then record which permissions each component inherits and which business systems those calls can touch.
- Scope MCP server authority tightly Review each MCP server as a privileged integration point and remove credentials, capabilities and service connections that exceed the agent’s job requirement.
- Move controls to the API layer Validate object-level and function-level authorisation on the APIs agents can reach, especially where autonomous workflows can trigger writes, transactions or state changes.
Bottom line: AI agent risk is not confined to the model layer because MCP servers and APIs can turn benign intent into harmful execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:58 pm
The agentic stack is an identity problem as much as an AI problem. The article’s most useful contribution is that it relocates AI agent risk from abstract model behaviour to the concrete places where authority is delegated and exercised. That matters because identity teams already understand that control breaks at the handoff point, not only at the point of intent. Practitioner conclusion: govern the agent’s reach, not just its output.
A few things that frame the scale:
- Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
A question worth separating out:
Q: Should AI teams prioritise API posture governance before broader model controls?
A: Yes, when the model’s real risk comes from exposed interfaces, not from the weights themselves. If the system relies on APIs for data access, tool calls and orchestration, fixing the interface layer first usually delivers the fastest reduction in exploitability and privacy exposure.
👉 Read our full editorial: The agentic stack exposes where AI agent risk actually lives