Enforcing a Single Policy Layer Across AI Agents, MCP Servers, and Agentic Skills in Code-Driven Enterprises

Enterprises now run dozens of models, hundreds of AI applications, and a growing population of autonomous agents. Governing that estate component by component is no longer possible. The practical answer is a single policy layer that treats agents, MCP servers, and agentic skills as first-class citizens under one enforcement plane, with identity, a gateway chokepoint, and continuous attestation built in from the start.

Why enterprises have an agent governance gap today

A bank deployed an internal agent to automate parts of its accounts payable workflow. The agent was shadow IT in spirit if not in name: it ran against an unvetted model, picked up a prompt injection, and began approving fraudulent invoices without a second look. The cascade did not require a sophisticated adversary. It required only that no enforcement point sat between the agent and the tool when the connection request arrived.

The velocity of adoption created this condition. A 2026 KPMG survey cited in Kaptein et al. found that security, compliance, and auditability are now the most critical requirements for agent deployment, but multi-agent orchestration complexity is the primary bottleneck as organizations move from pilots to production. The gap is not a lack of intent. It is a mismatch between the speed at which agents act and the speed at which legacy controls can see them.

Why agents, MCP servers, and agentic skills cannot be governed individually

The obvious fix is to govern each component. AI gateways enforce API-level rules. But neither manages enterprise-wide policy, identity, context, or audit across a heterogeneous agent estate. Treating agents, MCP servers, and skills as separate governance targets fails for a deeper architectural reason. Policy violations in agentic systems are properties of action sequences, not of individual actions. A single database read is innocuous. A database read followed by an external email is a potential exfiltration event. No inspection of either step alone reveals the violation.

Kaptein et al. formalize the problem: agent behavior is path-dependent and non-deterministic, so compliance policies must be deterministic functions that evaluate agent identity, partial execution path, proposed next action, and organizational state together. Standard RBAC was never designed for this. It eliminates action categories unconditionally but never conditions on prior actions, leaving it structurally blind to cross-step violations. Prompt-level instructions are a degenerate case. They shape the probability distribution over paths but provide no strict enforcement. An agent can still retrieve PII through an over-provisioned MCP server even when a system prompt says not to reveal it.

Recursive delegation compounds the failure. Two distinct governance jobs are also routinely conflated. Model governance asks whether an AI system is fair, documented, and compliant. Agent governance asks whether an agent had the right to take that action, and whether anyone can prove who it was acting for. Platforms built for one rarely cover the other well, and buying the wrong one leaves a real gap on the next audit. The EU AI Act's Article 10 turns this structural failure into legal exposure. Only a governed context delivery layer can.

What a single policy layer must actually do at runtime

Enforcement must sit close to tools, APIs, and data, not at the model boundary. Model-level controls operate only after data has already entered the context window. Context-layer guardrails enforce access control at retrieval time and tag data with classification labels before delivery. The distinction determines whether a violation is prevented or merely observed after the fact. Runtime evaluation is the general case. Static access control and prompting are degenerate special cases.

A four-layer governance architecture places global rules, workflow-specific rules, agent-specific rules, and situational rules in a cascade, so every agent action satisfies all applicable constraints simultaneously. places global rules, workflow-specific rules, agent-specific rules, and situational rules in a cascade, so every agent action satisfies all applicable constraints simultaneously. This mirrors how human compliance hierarchies work across enterprise, department, and individual role. Audit trails must be a byproduct of enforcement itself, not a separate logging exercise.

Five functional requirements follow. First, shadow AI discovery via behavioral fingerprinting. The speed requirement is non-negotiable. Mandiant's M-Trends 2026 records handoff times of 22 seconds. Governance that depends on a human reading an alert and pulling access is structurally incapable of intervening. Machine-speed enforcement is not a premium feature. It is the baseline.

Why agent identity is the prerequisite every other control depends on

Permissions, investigation, and kill switches all assume the enterprise can distinguish one agent from another. If several agents share the same account or rely on static credentials, none of those controls can function. Distinct machine identity per agent is not a feature of a mature governance program. It is the prerequisite for having one at all. Only a small minority of organizations maintain a real-time registry of active agents, and fewer still can trace agent actions back to a human sponsor across all environments. Most enterprises cannot answer the basic question: which agent did this, and who is responsible for it?

The EY/AIUC-1 Consortium survey cited in Bokkasam and Durgalakshmi found that a large share of organizations still use static API keys or username/password combinations for agent authentication. That is the opposite of the zero-standing-privilege architecture the field is converging toward. Microsoft added dedicated Entra service plans including Conditional Access for Agents and ID Protection for Agents, with worldwide rollout beginning July 2026 through Microsoft Agent 365 and Microsoft 365 E7 packaging.

Okta's strategic position differs. The identity layer also solves the deprovisioning problem that Active Directory solved for employees. When an employee leaves, agents running on personal API keys have no equivalent trigger. Nothing ties their actions back to a named person unless the agent identity is explicitly linked to a human sponsor in a managed registry. Speakeasy enforces RBAC through existing identity providers such as Okta and Entra ID rather than replacing them, which lets platform teams attach policy to identities they already manage.

The MCP gateway as the enforcement chokepoint for agent-to-tool traffic

MCP has become the dominant integration layer connecting agents to tools, APIs, and external systems. That concentration makes the MCP gateway the most practical single chokepoint for enforcing access policy. Without one, each MCP server requires separate credentials and configuration with no centralized governance layer. The protocol has reached production scale. Anthropic's December 2025 ecosystem update cited more than 10,000 active public MCP servers, and industry analysts predict a significant share of enterprises will operate their own MCP servers by the end of 2026. Ungoverned deployment is no longer a pilot-phase risk.

The spec is also moving quickly. Material releases landed in March, June, and July 2026 alone, so enterprises need a governance layer that can absorb spec changes without rewriting per-server configurations. The June 2026 Enterprise-Managed Authorization extension, known as EMA, formalizes enterprise IdP integration. IdP-native MCP governance is now technically feasible at scale.

The category has several credible entrants with distinct approaches. Kong AI Gateway launched an MCP Registry inside Konnect in February 2026, cataloguing and versioning MCP servers alongside the APIs they depend on with ownership and inherited policy. IBM ContextForge, open-source under Apache 2.0, federates MCP, A2A, REST, and gRPC services behind virtual servers, plugins, policy controls, identity features, and OpenTelemetry. Bifrost, also Apache 2.0 and self-hostable, acts as a native MCP gateway with 11 microseconds of internal overhead on a t3.xlarge at 5,000 requests per second, using virtual keys scoped at the tool level. Cloudflare MCP Server Portals aggregate every registered MCP server behind a single portal URL where access policies run through an existing identity provider, applying device posture checks and geographic restrictions. Boomi AI Gateway, formed after the acquisition of Lunar.dev closed on July 27, 2026, combines MCP gateway and LLM gateway functions in one control point beneath the Boomi Agent Control Plane. Speakeasy provides a governed distribution layer for MCP servers and agentic skills that enforces RBAC tied to Okta and Entra ID, detects shadow AI and prompt injection in real time, and surfaces cost and usage telemetry across a heterogeneous agent estate.

The architectural principle that separates strong designs from weak ones concerns when a tool is hidden. Hiding unauthorized tools at discovery time, so a compromised agent cannot even enumerate what it cannot reach, is materially stronger than blocking at execution time. Execution-time blocking still exposes the tool's existence to a prompt-injected agent reasoning about what to attempt. Discovery-time hiding shrinks what a compromised agent can reason about at all.

Shadow AI, prompt injection, and PII leakage as active threats the policy layer must intercept

These threats are not hypothetical risks for a future agent estate. The EchoLeak vulnerability in Microsoft 365 Copilot demonstrated that a zero-click prompt injection could access and silently exfiltrate enterprise data. Neither required an insider. Both exploited the gap between an agent and the tools it could reach.

Shadow AI inherits every problem shadow IT had while adding three new ones: prompt-level data leakage, prompt injection, and the fact that the model is a third-party data processor whose retention and training behavior is often unclear. These breaches also cost materially more than standard incidents on average, take longer to detect, and disproportionately expose customer PII and intellectual property. Detection speed is a financial priority, not just a compliance one.

The monitoring gap is widest precisely where regulatory exposure is highest. GDPR and EU AI Act Article 10 apply to exactly the traffic that goes unobserved. Effective interception requires three things working together: behavioral fingerprinting for shadow AI discovery, inline PII and secrets scanning at the context delivery layer before data reaches the agent, and prompt injection detection that operates on the full execution path context rather than on individual prompts in isolation. A policy layer that does not intercept these threats at the enforcement plane rather than the model boundary will not contain them.

Observability as the control that makes policy enforceable and auditable over time

Enforcement without observability is ungovernable over time. An organization can block individual actions but cannot demonstrate compliance, detect cost overruns, identify which agents are delivering value, or calibrate policy without a telemetry layer that turns autonomous behavior into measurable outcomes. This is the attestation deficit in its most consequential form. Governance exists on paper, but when a regulator or auditor asks for tamper-evident evidence of enforcement within their timeline, the organization cannot produce it.

Only a small fraction of organizations have end-to-end monitoring across their agent estate, and agent-to-agent coverage is far lower still. Audit trails must be a byproduct of enforcement itself. If logging is a separate pipeline that an agent can bypass, or that only captures successful completions, it cannot satisfy Article 10 of the EU AI Act or SOC 2 requirements for AI systems. Without all six, the audit trail is incomplete for any serious compliance framework.

Cost telemetry is the dimension that connects governance to the CFO. Without per-agent, per-tool usage telemetry, AI cost attribution is impossible. Speakeasy surfaces cost and usage telemetry across the organization alongside its enforcement events, which positions observability as part of the enforcement plane from day one rather than a reporting feature added after deployment. That is the only architecture that satisfies the attestation requirement when a regulator eventually asks for proof.

Building the policy layer in an enterprise where AI has already proliferated

The hardest part of building a single policy layer is not technical. AI has already proliferated across the organization in ungoverned ways, and a governance program that starts by demanding agents be shut down until reviewed will fail on political and operational grounds before it achieves any security outcome. The practical sequencing avoids the shutdown trap. Start with discovery, using behavioral fingerprinting to find what is already running. Then register and assign identity, linking every discovered agent to a human owner and an IdP group. Then enforce least-privilege at the MCP gateway layer. Then layer in real-time threat detection. Then close the loop with continuous attestation. Each step produces value without requiring the previous one to be perfect.

The identity-first principle applies to brownfield environments. The first governance win is connecting every discovered agent to a human sponsor in a managed registry, which immediately enables lifecycle management without requiring any agent to be rebuilt. The EMA extension makes IdP-native provisioning the path of least resistance for new MCP server deployments. When the IdP automatically provisions servers to authorized users, the governance layer is the deployment layer, and shadow MCP server creation becomes the exceptional case rather than the default.

The familiar objection is that an organization has hundreds of agents already running and cannot freeze the program while governance catches up. The answer is that a centralized policy layer can be inserted as a proxy between agents and their tools without modifying the agents themselves. That is how API gateways were adopted in the SaaS era, and it is how MCP gateways are being adopted now. Speakeasy is designed for exactly this brownfield scenario. Enterprises that build the governance layer as the deployment layer, not after, are the ones positioned to roll out AI safely from day one. The bank in the opening scenario lacked this layer entirely. Organizations that invest in it now will not find themselves explaining to an auditor why the invoice approval agent had no one watching it.