The Gateway Is Commoditizing — The Policy Stack Is Not

The gateway is becoming a commodity. The policy stack above it is not.

Gateway Sprawl Is Coming

At AGNTCon + MCPCon Europe last week, agent gateways went from optional to assumed in six months. Good news: nobody builds one from scratch. The trap: you will run three or four. An LLM gateway here, an MCP tool gateway there, an agent-to-agent layer somewhere else. That is how infrastructure sprawls in any company larger than a team.

Most make the same mistake: pick a gateway, accept its native policy engine, move on. It works until gateway two arrives — different team, different vendor — and now two policy models share no definition of a role or an approval.

Externalize the Decision Point

The fix predates agents by a decade: externalize the decision. One policy decision point. Every gateway asks it one question — should this call proceed — and executes the answer. Most gateways support this. Almost none ship that way.

Be precise about what belongs there. Anything decidable at call time belongs in policy: which agent, which tool, which data, at which classification, in which region, masked how far. Governance metadata does not — classifications, retention, lineage live in the catalog and feed in as inputs. Two policy types, two homes. Confuse them and your catalog pretends to enforce, or your gateway pretends to govern.

The Identity Gap

One complication makes this urgent: identity does not federate across gateways yet. The primitives exist — token exchange and per-agent workload identity. What is missing is a ratified standard for the agent as its own principal. MCP authenticates the application behind the agent. Cross two vendors and you reconcile two answers to "who is this agent" before you can ask "what is it allowed to do." Whoever owns the policy layer absorbs that gap, planned or not.

Done right, "this agent can call this tool under these conditions" is defined once, as versioned, reviewable code — one audit trail instead of four consoles. Done wrong, the compliance answer takes a week.

The honest counterpoint: every serious gateway ships a policy engine, and a shared layer is real engineering effort. One gateway, one team — use the native model. The abstraction earns its cost where sprawl is already guaranteed. The gateway was never the moat. It took the market this long to say so in public.

Who Owns the Rules

The question that stalls everything: who owns the decision point? The wrong answer is whoever owns the gateways. Enforcement operators writing policy ends exactly how it sounds. The split that works: platform teams operate the enforcement, security and data governance author the rules, and a named owner signs off on every change. Ownership becomes a review line in a pull request, not a paragraph in a RACI chart.

Before your next architecture review, two questions matter. Can you answer, in one place, which agents can touch which systems? Can you name the person who signs off when that answer changes? If the first takes four consoles and the second takes a Teams thread, the gateways were never your problem.