AI Agent Gateway: How to Govern Agent Traffic in 2026

An agent with a shared key can loop overnight and spend against the team's budget. An AI agent gateway applies identity, access and usage controls to agent traffic going to models, tools and other agents. Pick agentgateway for open-source A2A, Kong for A2A within Kong, Portkey or TrueFoundry for their platform controls, and Requesty for workload keys, caps and MCP.

We make Requesty, one of the products compared below. The comparison uses vendor documentation checked October 2026.

What does an AI agent gateway control?

A support agent might ask a model how to resolve a ticket, retrieve account details through a tool, and delegate a question to a separate specialist agent. Each hop needs its own policy decision.

The Model Context Protocol specification defines how clients use tools, resources and prompts exposed by servers. The Agent2Agent specification addresses communication between independent agent systems. A multi-agent application does not have to use A2A, and an MCP integration does not automatically govern agent-to-agent calls.

For a client-side tool, the model returns a proposed call and the agent runtime executes it. Some provider-hosted tools run on the provider's infrastructure, as Anthropic's tool-use documentation explains. Map each tool's execution path: an LLM proxy does not automatically authorize a separate MCP call made by the runtime.

A gateway's control plane configures policies; its data plane checks requests. An agent control plane is a broader management layer for agent registration, policies and lifecycle. The agent runtime or workflow system executes steps and maintains required state. Products divide these responsibilities differently.

No policy can govern a request that goes around it. This follows the zero-trust principle in NIST SP 800-207: network location alone is not a reason to grant trust.

Where agent traffic creates risk

Picture a support agent allowed to read tickets and draft updates. A tool response tells it to export the customer database. Blocking an unapproved export tool reduces exposure, as does a database role that cannot read the full customer table. If the agent can run a local script with a privileged database credential, an MCP gateway alone cannot stop that path. The MCP security guidance covers token misuse, local server risks and other trust boundaries.

How to govern AI agents in a company

Identify the caller and the person behind the task

Authentication establishes which credential or principal is calling. Authorization decides what that caller may do. For a delegated task, validate the initiating user or service and the agent making the call where your identity system supports both. The action should fit both the initiator's authority and the agent's assigned scope.

Give a separate credential to each workload that needs an independent cap, permissions or revocation. Keep it in a secret manager, set an expiry and restrict where it can be used. A gateway key is still a bearer secret: someone who steals it can exercise the permissions attached to it.

Now, the not so great news on attribution. If six subagents share the parent process and only the parent makes outbound model calls, the gateway sees the parent's key. Instrument the orchestrator or give the subagents separate outbound clients if you need to distinguish their calls. Our guide to shared API keys and agent attribution covers the operational tradeoff.

A task ID, a client-supplied agent name or a User-Agent header helps join records. None proves which process or person made the request. Use a validated credential for the access decision and metadata for investigation.

Give tools the smallest useful scope

For each agent, define the allowed models, servers, tools and target resources. Separate read access from write access. For an action that changes records, specify who can approve it, what threshold requires review and where that approval is enforced.

Let the support agent read a ticket and draft an update. A separate approval service approves a specific ticket and exact proposed changes. Bind approval to those arguments so a later substitution requires a new decision. The ticket service, or trusted middleware immediately in front of it, verifies the approval with the trusted approval service, checks the authorized actor, expiry, ticket and final write arguments, and prevents the approval from being reused for another operation. Enforce single use atomically so concurrent attempts cannot both consume the approval. Prevent the agent from bypassing that check. The ticket service must also check whether the acting identity can update that ticket.

At the protocol level, MCP authorization is optional. In the specified HTTP authorization flow, MCP servers validate tokens for their intended audience. Check authentication on both legs: agent to gateway and gateway to server. Do not forward a token issued for one audience to a different server; use a credential intended for the downstream service.

Bound the task as well as the monthly bill

A monthly key cap limits cumulative model spend for a workload. Set a task spend limit below the workload's monthly allowance, and cap steps and retries separately. Test how the task budget handles concurrent requests and final costs.

For parallel workers, keep one task ledger in a trusted orchestrator or budget service. Atomically reserve budget before admitting each model call, then reconcile the reservation with the final charge. For a strict task cap, reserve a conservative upper bound for every charge the task budget covers, including input, capped output, provider-hosted tools and every potentially billable retry or fallback attempt. Count attempts made inside the gateway as well as those initiated by the runtime. Admit separately billed tool calls through the same ledger if the task cap includes them. If you cannot establish an upper bound, reject the call. An operator can approve a higher task budget, but approval alone does not make an unbounded call fit a strict cap.

Keep the reservation until the final charge or an uncertain outcome is reconciled. Every worker and retry must pass through the admission check, with gateway-internal attempts covered by the reservation for the admitted request. Independent local counters cannot enforce a shared allowance.

Concurrency controls limit simultaneous requests, while alerts notify an operator. Separately billed tools and irreversible writes need their own controls.

Assume four subagents each make 12 model calls at $0.04 per call. The run costs 4 x 12 x $0.04 = $1.92 in model calls. If each repeats the same work once at the same cost, that becomes $3.84. The model bill is only part of the task if a tool also charges for searches or executes a paid transaction.

Set bounded retries. For a write that times out, first determine whether the target service completed it; a blind retry can duplicate the action. Use the downstream API's idempotency mechanism where available, and reconcile uncertain outcomes. See how to cap runaway agent spend for the loop mechanics.

Test monthly budget behavior with concurrent and streaming requests near the limit. Record the cost and outcomes of requests already in flight.

Join records without collecting everything

Record a stable task or trace ID, the authenticated credential or principal, the initiating identity when available, model, tool or server, action, decision, timestamps, errors, token usage and cost. Join records across the runtime, gateways and target service. A single gateway log is rarely the whole task.

For an illustrative task ticket-123, the evidence could look like this:

The application must propagate those IDs, and each system must record them. If the MCP gateway or ticket service loses the link, the record has a gap; a matching ID alone does not prove identity or authority. In Requesty, client-supplied request metadata can label model requests for correlation, while the credential authenticates the gateway call.

Prompts, tool arguments and responses can contain sensitive information. Decide which fields to store, who can read them and when to delete them. An incident responder needs enough detail to reconstruct a decision without unrestricted access to every customer record the agent saw.

Close the bypass paths

Remove direct provider credentials from the agent environment. Restrict network egress to approved model and tool paths. Inventory local MCP servers and scripts: MCP's security guidance notes that local servers run with the client's privileges. A network gateway cannot inspect a local filesystem operation that never crosses it.

Decide what happens if a gateway or identity service is unavailable. For sensitive writes, fail closed and route the task to a queue or person. For other work, choose the recovery behavior explicitly and test it. Do not leave a direct provider key in the runtime as an undocumented emergency fallback.

AI agent gateway comparison in 2026

As of October 2026, these products cover different parts of the problem. Choose by protocol, identity and operating model.

For open-source self-management, pick agentgateway. The Linux Foundation announcement describes the project, and its project documentation places it under the Agentic AI Foundation. Your team owns deployment, policy integration and upgrades.

Pick Kong if your team already uses Kong for API governance. Its MCP proxy is an Enterprise offering, and its A2A proxy requires an AI license and a compatible Kong Gateway version.

Pick Portkey when the two authentication legs and workspace tool choices are central to your design. Its tool provisioning documentation says disabled capabilities are hidden and return errors on direct calls. For hybrid deployments, establish where logs are stored alongside the chosen MCP and A2A configuration.

Pick TrueFoundry when the agent registry and platform deployment fit your architecture. Its implementation status distinguishes current controls from planned agent-aware per-hop exchange. The registry documentation separately describes Microsoft Entra on-behalf-of authentication for a proxied agent endpoint.

Set up model and MCP controls with Requesty

Use Requesty to give a support agent its own model access policy and monthly budget, then register its MCP server separately. The target service owns its resource permissions.

1. 1
   Create a workload key

   On pay as you go, create a dedicated API key with a label, expiry and monthly key limit. An administrator can also create a service account and assign it a key, so the workload's spend is separate from an individual user's. Requesty's plan documentation includes service accounts and access lists on pay as you go. Store the key as a secret and give it only to the workload that needs it.

   On pay as you go, members can see organization-wide analytics and logs. Enterprise scopes these views by role, so account for that distinction when choosing what to log.

2. 2
   Restrict models and connect the model client

   Create an access list containing the approved models and attach it to the key. Make each key-level list a subset of your intended organization policy. A key-level list takes precedence over a group list. If no model list is configured at any level, every model in the Requesty catalog is allowed. Review the effective policy and test an unapproved model for each workload key.

   Install Claude Code and add credits for a paid model. If Claude Code is already installed, use version 2.1.284 or later for Sonnet 5.5; see Claude Code model configuration. Follow the Requesty Claude Code integration, inject the workload key into REQUESTY_API_KEY, then run:

   Shell

   Copy

   export ANTHROPIC_BASE_URL="https://router.requesty.ai"
   export ANTHROPIC_AUTH_TOKEN="$REQUESTY_API_KEY"
   export ANTHROPIC_MODEL="anthropic/claude-sonnet-5-5"
   claude

   These exports configure the current shell session. Claude Code background agents hosted by the supervisor do not reliably inherit shell-only gateway settings; distribute settings through a supported settings file and your secrets tooling, verify the route and credential in each workload, and keep egress restrictions in place.

   Include that model in the access list, or choose another allowed model from the model library. Connecting the model client does not configure MCP traffic.

3. 3
   Register the tool server

   In the Requesty dashboard, register the server, configure its upstream authentication and select the tools the organization needs. Requesty's MCP Gateway supports Streamable HTTP and SSE servers; local stdio servers need separate controls. Standard uses organization-wide upstream authentication; Enterprise can enable per-user MCP keys.

   Ask Requesty support for a confirmed connection for your client, then test discovery and an enabled tool call. Use the MCP server or another policy layer for per-agent tool permissions and target-resource checks. Requesty's documented tool selection is organization-level.

4. 4
   Set alerts and review key use

   Configure a Slack, Teams or JSON webhook in Alerts, then create an API key spend threshold and test that the operator receives it. Requesty blocks new requests for a key when its spend limit is reached.

   The key security view shows administrators client names supplied in User-Agent and X-Title over the last 30 days. A new tool plus a traffic spike of about 3x normal is flagged Critical. These names are supplied by callers, so investigate the key before deciding what happened. Expire now kills a suspect key in one click; expiry is reversible.

Requesty's in-flight limits control organization-wide concurrency, not requests per minute. Add per-run step and spend limits in the agent runtime and review the MCP server's own authorization before production.

Test the boundary before production

Run these tests with a non-production agent and test resources. Record the expected decision and the system responsible for enforcing it.

If a server connects but a tool is missing, check server selection, client and server authentication, and the MCP versions and transports on both sides. A 401 can be the expected OAuth discovery challenge; if access still fails, inspect WWW-Authenticate and the credentials on that hop. A 403 calls for an authorization and scope review. Inspect the response and logs at each hop before changing permissions. Kong's MCP version guide explains why clients and servers on different revisions need compatibility testing.

What to do this week

Start with one agent and one read-only tool. Give the agent its own key, set a monthly cap and configure an MCP tool allowlist. Run the acceptance tests before adding a write, and repeat them for each new path. Start with Requesty for the model and MCP portions.