The Control Plane: Firewalls & Gateways for the Agent Era

If IAM defines who can act, the Control Plane enforces what they can actually do. In the world of Agentic AI, the network firewall is insufficient. We need application-layer controls that understand the semantics of AI interaction.

This has given rise to two critical infrastructure components: Agent Firewalls and MCP Security Gateways.

1. Agent Firewalls

An Agent Firewall sits between the LLM and the outside world (users and tools). Unlike a WAF, it doesn't just look for SQL injection strings; it inspects the intent and reasoning of the model.

Core Capabilities:

• Input Filtering: Detects prompt injection, jailbreaks, and PII in user inputs.
• Output Guardrails: Blocks hallucinations, toxic content, and data leakage in model responses.
• Reasoning Inspection: Monitors the "Chain of Thought." If an agent plans to "delete all users" to solve a "disk space" problem, the firewall blocks the plan before any tool is called.
• Context Awareness: Understands session history. A single request might look innocent ("execute file"), but in the context of previous messages ("download malware"), it is a threat.

Leading Players: GuardionAI, Lakera, Pillar Security, Aporia.

2. MCP Security Gateways

The Model Context Protocol (MCP) is becoming the standard for connecting agents to data and tools. However, it also standardizes the attack surface.

An MCP Security Gateway acts as a proxy for all tool calls.

Why You Need It:

• Shadow AI Discovery: Developers spin up local agents connecting to production DBs. An MCP Gateway detects and inventories these connections.
• Tool Sanitization: Prevents "Tool Poisoning." It validates the parameters sent to tools (e.g., ensuring a file path doesn't escape the sandbox).
• Policy Enforcement: "Agent A can only call read_invoice on the Finance MCP Server if the invoice amount is < $10k."
• Drift Detection: Alerts if an agent starts using a tool in a statistically anomalous way (e.g., calling search_users 5,000 times in a minute).

Leading Players: Lasso Security, Akto, Archestra.

3. Contextual Agentic Security

The next frontier is Contextual Security. Instead of binary block/allow rules, these systems guide the agent toward safer behavior.

• Scenario: An agent tries to access sensitive PII to answer a user question.
• Binary Block: The request fails. The agent crashes or hallucinates an excuse.
• Contextual Feedback: The gateway returns an error: "Access denied to raw PII. Please use the get_anonymized_stats tool instead."
• Result: The agent self-corrects and completes the task securely.

Startups to Watch: Geordie AI, Harmonic Security, Fabraix.

CISO Takeaway

The perimeter has moved. It is no longer the network edge; it is the Tool Interface.

You must instrument the point where your Agents connect to your APIs. Without an inspection layer at this junction (via an Agent Firewall or MCP Gateway), you are effectively exposing your internal systems to the open internet via a non-deterministic, easily tricked proxy (the LLM).

Continue to the next section: Observability & Red Teaming