The two-door problem: splitting governance across an MCP gateway and an LLM gateway leaves a gap

2026-07-30 · Source: Stacklok · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Advanced, medium

Summary

AI agent governance faces a "two-door problem" where agents interact with models via an AI gateway and invoke tools through an MCP gateway. Enterprises commonly deploy separate vendors for these functions, creating a critical security gap. This split governance allows cross-door attacks, such as prompt injection or data exfiltration, to exploit the seam by entering through one gateway (e.g., a tool result) and exiting through another (e.g., a model call), bypassing detection. Unified governance, provided by a single vendor, addresses this by ensuring consistent identity across actions, enabling a single policy definition for both gateways, and consolidating audit trails into one timeline. While small, internal, or single-door agent deployments might tolerate split governance, unified solutions are essential for agents utilizing both models and tools, those under audit or compliance obligations, and organizations defending against sophisticated cross-door attacks.

Key takeaway

For AI Security Engineers evaluating agent security solutions, recognize that splitting governance between separate model and tool call gateways introduces critical vulnerabilities. If your agents both call models and invoke tools, or if you face audit obligations, you must prioritize unified governance from a single vendor. This approach ensures consistent identity, a single policy framework, and a consolidated audit trail, effectively closing the seam exploited by prompt injection and data exfiltration attacks.

Key insights

The "two-door problem" in AI agent governance arises from splitting model and tool call monitoring, creating a critical security gap.

Principles

• Unified governance closes cross-door attack vectors.
• Consistent identity and single policy prevent security gaps.
• A unified audit trail simplifies incident response.

Method

Unified governance integrates model and tool call monitoring within a single control plane, enforcing consistent policies and identity across both gateways to detect cross-door attacks.

In practice

• Adopt unified governance for agents using both models and tools.
• Prioritize unified governance for audit and compliance needs.
• Defend against prompt injection with cross-door visibility.

Topics

• AI Agent Security
• LLM Gateways
• MCP Gateways
• Unified Governance
• Prompt Injection
• Data Exfiltration

Best for: AI Security Engineer, AI Architect, Director of AI/ML

Related on AIssential

• How can enterprises govern MCP connections at scale? — MCP connections, enabling autonomous agent actions, demand robust governance to mitigate significant enterprise risks.
• The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials — AI agent adoption outpaces security controls, leading to frequent incidents due to poor identity management and isolation.
• The Next Evolution of Fairness: Why LTAE and LAAM are expanding into AI Safety. — AI safety's structural failures, mirroring human oversight issues, necessitate governance frameworks like SLAAM to prevent asymmetric enforcement and anchor drift.
• Agentic Analysis for Agentic Infrastructure: An LLM-Powered Pipeline for Comparative Governance of DAO and Corporate AI Protocols — LLM-powered analysis reveals comparable participation inequality in permissionless and corporate AI agent governance, despite denser discourse alignment in open settings.
• A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents — A five-plane architecture provides runtime governance for production AI agents by mediating delegated actions.
• Bridging data and AI governance: why it matters now — Fragmented data and AI governance creates significant operational, financial, and regulatory risks, especially with agentic AI.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Stacklok.