The Agent Control Plane: Engineering Runtime Authorization for MCP and AI Tool Calls

The security boundary for AI systems has moved, and most enterprise architectures have not moved with it. For two years the industry treated large-language-model risk as a content problem — jailbreaks, unsafe completions, refusals that a determined user could argue around. That framing was survivable while models only produced text. It stopped being survivable the moment agents were handed credentials.

An agent that can issue a refund, merge a pull request, rotate a DNS record, or export a customer table is not a chatbot with a safety rating. It is an unattended workload with write access, driven by a probabilistic planner that reads attacker-controlled input as part of its normal job. The industry's answer is converging on a pattern borrowed directly from Zero Trust networking: stop trying to make the model refuse, and make the action impossible. That enforcement point now has a name — the agent control plane.

---

Prompt Injection Was Never a Content Problem

Prompt injection has resisted a general fix since Riley Goodside first demonstrated it in 2022, and the reason is structural rather than incidental. A transformer receives instructions and data in the same channel. There is no privileged band, no equivalent of a parameterized SQL query that lets a developer say this part is code, that part is input. Every mitigation to date — delimiters, spotlighting, instruction hierarchies, guard classifiers — reduces the success rate of an attack. None of them reduces it to zero, and an unattended agent running thousands of calls a day converts a low per-attempt success rate into a near-certain eventual breach.

Simon Willison's lethal trifecta framing captures the practical risk boundary: an agent is exploitable for real damage when it simultaneously has access to private data, exposure to untrusted content, and a channel to communicate externally. Remove any one leg and the exfiltration path collapses. Most production agent deployments have all three by design, because all three are what makes the agent useful.

The failure mode is a textbook confused deputy. The agent holds legitimate authority delegated by an operator. An attacker who cannot use that authority directly supplies content the agent will read — a support ticket, a scraped page, a PDF attachment, a code comment, a calendar invite — and induces the agent to spend its authority on the attacker's behalf. The tool call that results is perfectly well-formed and perfectly authorized. Nothing in the request looks like an attack, because nothing about it is an attack at the protocol layer.

Operator intent
B

This maps to LLM01: Prompt Injection and LLM06: Excessive Agency in the OWASP Top 10 for LLM Applications, and to the initial-access and impact stages of MITRE ATLAS. The two entries are usually read as separate risks. In an agent deployment they are a single kill chain: injection supplies the intent, excessive agency supplies the capability, and the damage is proportional to the second, not the first.

---

Why the Model Layer Cannot Be the Only Control Point

Guard models — classifiers that score inbound content or outbound actions for injection, policy violation, or data leakage — are genuinely useful and genuinely insufficient. They are statistical detectors with a false-negative rate, deployed against an adversary who can iterate offline until they find the input that scores clean. Treating a classifier as the enforcement boundary reproduces the same architectural mistake as a WAF used in place of parameterized queries.

The deeper problem is that most agent deployments have no authorization layer at all. The prevailing pattern is to hand the agent a long-lived API key with the scopes a human operator would hold, then hope the system prompt constrains behaviour. That produces three compounding defects:

• Static credentials in the context window. A key held by the agent is a key inside the blast radius of every injection. It can be exfiltrated, and it outlives the session.
• Human-scale scopes on non-human volume. A support engineer issuing refunds is rate-limited by being a person. An agent with the same token is not.
• No decision record. Application logs capture that a tool ran. They do not capture which policy evaluated the call, what the agent's clearance was, or what alternative the planner considered — which is precisely the evidence an incident responder or an auditor needs.

Non-human identities already outnumber human ones in most cloud estates by a wide margin, and agents are the fastest-growing class within that population. The control gap is not novel. It is the 2015 microservice-credential problem, arriving again with a planner attached.

---

The Model Context Protocol Widened the Blast Radius

Anthropic's Model Context Protocol, open-sourced in November 2024, solved a real integration problem: it gave agents one standard way to discover and invoke external tools. Adoption across IDEs, agent frameworks, and SaaS vendors has been unusually fast. It also created a supply chain where none existed, and the security research that followed has been consistent.

The last row is the one that defeats manual review. Approving read_customer_record is reasonable. Approving send_email is reasonable. Approving both, for the same agent, in the same session, is the lethal trifecta assembled out of two defensible decisions.

---

Anatomy of an Agent Control Plane

The emerging architecture is a mandatory intermediary. The agent no longer holds upstream credentials or reaches tools directly; it points at a broker that authenticates the calling workload, evaluates the requested action against policy, brokers a scoped credential, and writes an immutable record. Three verbs describe it: intercept, decide, prove.

PL
V
GM
Denied and recorded
(Signed audit ledger)

The primitives that distinguish a control plane from a logging proxy are worth naming precisely, because vendor marketing tends to collapse them:

The hold verdict deserves emphasis. Most access-control systems offer allow or deny. Agent traffic is dominated by actions that are neither clearly safe nor clearly hostile — a larger-than-usual refund, an unfamiliar recipient, a first-time destructive call. Without a hold path, operators are pushed toward permissive policy to keep the agent functional, which is how least privilege quietly erodes.

---

A Reference Implementation: Arcitix Warden

Arcitix is one of the vendors building to this shape, and its Warden product is a useful worked example because the company publishes its architecture in more detail than most of the category. The figures below are vendor-published and not independently verified; Warden is in private preview rather than general availability, and Arcitix states plainly that the metrics in the demo console on its homepage are synthetic.

Warden positions itself as "the control plane between your AI agents and everything they can touch." Agents are repointed at a Warden endpoint rather than calling tools directly, which the company says works across MCP server proxying, OpenAI and Anthropic tool-calling, plain HTTP, and gRPC — and therefore across LangGraph, CrewAI, or a bare SDK loop without rewriting agent code. That protocol breadth matters more than it sounds: a control plane that only speaks MCP misses the HTTP calls an agent makes directly, and a partial chokepoint is not a chokepoint.

Identity and credentials. Each agent receives a SPIFFE workload identity scoped per environment. Upstream credentials are brokered with a stated 15-minute lifetime and are never held by the agent. Entitlements are expressed as a per-agent matrix across read, write, money movement, egress, and secrets, with a data-class clearance ceiling — public, internal, confidential, restricted — applied to every retrieval.

Inline analysis. Arcitix describes three quantized guard models totalling roughly 4.6B parameters: warden-inj3B for injection and intent classification, warden-seq1.3B operating over the agent's tool-call graph rather than single calls, and warden-pii340M for entity and secret detection. The sequence model is the architecturally interesting one, since composition attacks are invisible to per-call classifiers.

Latency. The company publishes a decision budget rather than a single marketing number, which is the more honest presentation:

Vendor-published decision budget for a single brokered tool call, resolving to one of three verdicts.

Evidence. Every decision produces a signed, hash-chained record of who asked, what was attempted, which policy fired, and why, with session replay for end-to-end reconstruction and export into Splunk, Sentinel, or Chronicle. Arcitix maps this to EU AI Act Article 12 record-keeping, NIST AI RMF, and SOC 2 CC7.

Deployment and failure modes. Three models are offered — fully hosted; hosted control plane with guard models running on customer GPUs so payloads never cross the tenant boundary; and fully air-gapped. Failure behaviour is configurable per agent: fail-closed for money movement and production changes, fail-open with a logged gap for low-risk reads. A sidecar retains cached policy decisions if the control plane becomes unreachable.

That last configuration choice is where buyers should concentrate their diligence. Fail-open is an availability decision that silently becomes a security decision during exactly the network conditions an attacker would like to induce. Any control plane evaluation should include a test of what the agent can do while the broker is unreachable — and that question applies to every vendor in this category, not just this one.

---

The Wider Field

Warden is not alone, and a buyer should treat the category as contested rather than settled. Microsoft has published an open-source Agent Governance Toolkit that sits between an MCP client and its tool servers and evaluates each call against policy. A cluster of independent MCP gateways offers identity-brokered access with allow, deny, and require-approval verdicts. Policy-as-code engines such as Open Policy Agent and Cedar are being retrofitted to tool-call authorization, which trades purpose-built agent semantics for a mature, auditable policy language. The hyperscalers are adding agent identity primitives to their existing IAM stacks, where the integration advantage is real and the agent-specific analysis is thinner.

The differentiators worth testing are consistent across the field: protocol coverage breadth, whether policy evaluates sequences or only individual calls, whether credentials are genuinely brokered or merely proxied, whether the ledger is cryptographically tamper-evident or just a log table, and whether new policy can be simulated against real historical traffic before it is enforced.

---

Practical Sequence for Security Teams

The control plane is an architectural commitment, but the first three steps are not, and they retire most of the risk.

1. Inventory the agents that can write. Read-only agents are a data-governance question. Agents that move money, mutate infrastructure, send external messages, or merge code are the entire acute problem. Most organisations discover more of these than expected, and most are running on a developer's personal token.
2. Kill static credentials first. Before any policy engine, remove long-lived keys from agent context and move to brokered, short-lived, scoped credentials. This single change breaks the exfiltration leg of the trifecta.
3. Break the trifecta per agent. For each agent, cut private-data access, untrusted-content exposure, or the external channel. If all three are genuinely required, that agent needs mandatory approval on its egress path.
4. Set fail-closed on the money and production paths. Make the choice explicitly and test it under a simulated broker outage.
5. Log decisions, not just calls. If your telemetry cannot answer "which policy allowed this and what was the agent's clearance," you cannot run an incident, and EU AI Act Article 12 will eventually make that a compliance problem rather than an operational one.
6. Cap blast radius numerically. Spend limits, row limits, and change budgets fail safe in ways that classifiers do not, because they do not depend on recognising the attack.

---

Bottom Line

Prompt injection is unlikely to be solved at the model layer on any timeline that helps a team shipping agents this quarter. Accepting that is not defeatism; it is the same concession the industry made about memory-unsafe input decades ago, and the response is the same — stop relying on the parser's judgement and constrain what the resulting action is permitted to do.

The agent control plane is that constraint, and it is the correct architectural layer for it: deterministic, auditable, and outside the reach of the context window it governs. Whether a given organisation buys Arcitix Warden, adopts an open-source gateway, or builds against OPA is a procurement question. Whether tool calls get an authorization boundary at all is not.

---

Disclosure: Arcitix supported the research time behind this article. ThreatFrontier retained full editorial control; no vendor reviewed the copy before publication, and all vendor-supplied figures are identified as such in the text.