Enterprises may be installing AI gateways too early in their security stack. A gateway can check a credential and inspect an API call, but it cannot judge whether an agent’s action fits its assigned task unless the organization first records who delegated the work, which agent is acting and what scope it received.
The risk is already concrete. A LiteLLM flaw added to the US Cybersecurity and Infrastructure Security Agency’s exploited-vulnerability catalog allowed commands to run on a gateway host; when chained with another flaw, it required no credentials. The incident shows that the enforcement layer can itself become an attack surface.
A more durable sequence starts with a distinct identity for each agent, links that identity to a human or service owner, and issues short-lived credentials for a specific task. Organizations then need session records that preserve the delegation chain and tool activity. Only after that context exists can a gateway distinguish a permitted action from one that is technically valid but unrelated to the job.
The practical lesson is not to abandon gateways. It is to treat them as a downstream control whose decisions depend on identity, attribution and observable sessions already being in place.