SIGNAL 01
Reviews don't scale
"Security won't approve every team running its own MCP server — and shouldn't have to."
Solutions
Five patterns nearly every enterprise hits in its first year of MCP — each one a governance story with named controls. Not features in the abstract: an agent that reads but never writes, an API that becomes three safe tools, a workload that finally has a name.
ILLUSTRATIVE SCENARIOS · GENERIC NAMES, REAL CONTROLS · ALL SCREEN DATA IS SAMPLE
DENY — contract review agents cannot mutate CRM state in production.
A contract-review agent spends its day on contract_read against the legal team's MCP server and read-only CRM account lookups — conditioned on the human it acts for being in the sales or legal group. Then it calls crm_update_opportunity_stage (risk: high) in production. Policy denies before the CRM is ever touched, and the developer reads the reason instead of filing a ticket.
TWO CALLS FROM THE SAME AGENT, MINUTES APART — SAMPLE DATA
"We didn't write a server. We selected three operations and attached policy."
The CRM's REST API arrives as an OpenAPI spec with 40 operations. Three are selected, approved, and published as governed MCP tools — each with an owner, a risk label, and a credential mode. The other 37 endpoints don't show up as denied. They don't exist to agents at all.
PRE-FLIGHT ON EVERY CALL: HOST ALLOWLIST PINNED TO THE PRIVATE HOSTNAME · SCHEMA VALIDATION · TIMEOUT AND RESPONSE-SIZE LIMITS — SAMPLE DATA
"Who is svc-shared-3, and why does it have write access to billing?"
A nightly ETL job and the CI pipeline have been calling internal tools with a shared key nobody remembers issuing. Behind the gateway they become first-class identities: Kubernetes or cloud workload identity maps to a gateway subject, credentials are brokered per call, and every action lands in the audit trail under its own name. Revocation reaches active sessions — no redeploy, no rotation scramble.
THE SHARED KEY IS RETIRED — EVERY WORKLOAD ACTS UNDER ITS OWN NAME · SAMPLE DATA
"The fastest security review is the one that already happened."
A product team wants to expose an internal capability to the company's agents. Instead of rebuilding auth, RBAC, credential injection, audit, and private connectivity themselves, they register the server — or import its spec — select operations, attach policy, bind credentials, and submit for approval. It ships in a day, on a pattern security has already reviewed once.
SECURITY REVIEWED THE PATTERN ONCE — THIS TEAM ONLY FILLED IN THE SPECIFICS · SAMPLE DATA
"Disable one tool. Not the platform, not the team's quarter — one tool."
During an incident, security needs one tool gone — now. Emergency disable previews the blast radius before it fires, requires a reason, blocks new calls, and reaches live sessions. The morning after, the audit trail shows exactly what the agent touched and when — metadata only, so the review never has to handle payloads.
FOUR MINUTES FROM DECISION TO CONTAINMENT — ILLUSTRATIVE TIMELINE, SAMPLE DATA
The signals
Five things we hear in first conversations — before anyone says the word gateway. Count how many are yours.
"Security won't approve every team running its own MCP server — and shouldn't have to."
"We have far too many internal APIs to hand-build an MCP server for each one."
"We need auditability in place before agents act inside internal systems — not after the first incident."
"We can't route private tools through a vendor-hosted control plane. The traffic stays in our network."
"When we need to revoke agent access, it has to happen in minutes — not in meetings."
Then a walkthrough is worth 25 minutes: your architecture, the scenario closest to yours, and what a pilot would prove.
Next step
Twenty-five minutes on your architecture: where the gateway sits, which controls your first boundary exercises, and what a pilot would prove.