Layer 7 of 8, Protect what runs
Agent and tool access: limit what agents can do and require approval
This layer limits which tools, MCP servers, data and credentials an agent can use, and which actions need a person's approval, through gateways, tool policy, agent identity and sandboxes.
Executive summary
- What it is
- This layer limits which tools, MCP servers, data and credentials an agent can use, and which actions need a person's approval, through gateways, tool policy, agent identity and sandboxes.
- The risk
- Agents with too many tools, permissions or autonomy, poisoned MCP tools and servers that change after approval, abuse of delegated tokens, and data sent out through a chain of allowed tool calls.
- What to buy or do
- Before agents touch production systems, put an MCP gateway or agent security platform between agents and tools, scope each tool to least privilege, require approval for high-impact actions and keep a kill switch. Plan it with your identity team.
Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.
The question this layer answers
What can our AI agents do with the tools, data and credentials we gave them, and who approves risky actions?
Budget line
An agent security platform or MCP gateway, next to identity and access management and API security.
What it protects against
Our analysis
- Agents with too many tools, permissions or autonomy
- Tool poisoning and rug pulls in MCP servers
- Tool misuse and chained exfiltration
- Abuse of delegated credentials and tokens
- Risky actions without approval
- Agents that drift from their task
Typical controls
Our analysis
- MCP server scanning and pinning
- MCP gateway or proxy with allow and deny lists
- Least-privilege tool scopes
- Agent identity bound to the person it acts for
- Per-action policy engine (allow, block, shut down)
- Human approval for high-impact actions
- Agent runtime monitoring and kill switch
- Checks on tool output before the agent acts on it
How it maps to standards
Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.
| Framework | Entry | Basis | Where the source says it | How it applies |
|---|---|---|---|---|
| OWASP LLM Top 10 (2025) | LLM06 Excessive Agency | Source states | Prevention list | Minimize extensions, use granular tools, grant minimum permissions, act in the user's context with minimal OAuth scopes, require human approval and enforce downstream authorization. |
| OWASP LLM Top 10 (2025) | LLM01 Prompt Injection | Source states | Prevention list | Least-privilege tokens with functions run in code, and human approval for high-risk actions. |
| OWASP LLM Top 10 (2025) | LLM07 System Prompt Leakage | Source states | Prevention list | Privilege separation outside the model, and separate agents with least privilege. |
| OWASP LLM Top 10 (2025) | LLM05 Improper Output Handling | Our analysis | Not named by the source | Validating tool-call arguments before execution. |
| OWASP Agentic Top 10 (2026) | ASI01 Agent Goal Hijack (opens in a new tab) OWASP relates it to LLM01, LLM06. | Source states | Mitigation 2 | Least privilege for agent tools and human approval for high-impact actions. |
| OWASP Agentic Top 10 (2026) | ASI02 Tool Misuse and Exploitation (opens in a new tab) OWASP relates it to LLM06. | Source states | Mitigations 1, 2, 4, 5, 7 | Least agency and least privilege for tools, action-level authentication and approval, policy enforcement middleware, adaptive tool budgeting, and semantic and identity validation. |
| OWASP Agentic Top 10 (2026) | ASI03 Identity and Privilege Abuse (opens in a new tab) OWASP relates it to LLM01, LLM06, LLM02. | Source states | Mitigations 1, 3, 4, 6 | Task-scoped and time-bound permissions, per-action authorization, human in the loop for privilege escalation, and agentic identity management platforms. |
| OWASP Agentic Top 10 (2026) | ASI04 Agentic Supply Chain Vulnerabilities (opens in a new tab) OWASP relates it to LLM03. | Source states | Mitigations 7, 8 | Pin prompts, tools and configs by content hash, and keep a supply chain kill switch. |
| OWASP Agentic Top 10 (2026) | ASI07 Insecure Inter-Agent Communication (opens in a new tab) OWASP relates it to LLM02, LLM06. | Source states | Mitigation 4 | Enforce version and capability policies at gateways or middleware. |
| OWASP Agentic Top 10 (2026) | ASI08 Cascading Failures (opens in a new tab) OWASP relates it to LLM01, LLM04, LLM06. | Source states | Mitigations 3, 4, 7 | Just-in-time tool access with runtime checks, an independent policy engine and blast-radius limits. |
| OWASP Agentic Top 10 (2026) | ASI09 Human-Agent Trust Exploitation (opens in a new tab) OWASP relates it to LLM01, LLM05, LLM06, LLM09. | Source states | Mitigation 1 | Explicit confirmations before sensitive data access or risky actions. |
| OWASP Agentic Top 10 (2026) | ASI10 Rogue Agents (opens in a new tab) OWASP relates it to LLM02, LLM09. | Source states | Mitigations 2, 4, 5 | Isolation and boundaries, kill switches and credential revocation, and identity attestation. |
| MITRE ATLAS | AML.M0029 Human In-the-Loop for AI Agent Actions | Source states | Mitigation name | The mitigation's name is the control. |
| MITRE ATLAS | AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data | Source states | Mitigation name | The mitigation's name is the control. |
| MITRE ATLAS | AML.M0033 Input and Output Validation for AI Agent Components | Source states | Mitigation name | The mitigation's name is the control. |
| MITRE ATLAS | AML.T0053 AI Agent Tool Invocation | Our analysis | Not named by the source | Tool invocation by an agent. |
| MITRE ATLAS | AML.T0086 Exfiltration via AI Agent Tool Invocation | Our analysis | Not named by the source | Exfiltration through agent tool calls. |
| MITRE ATLAS | AML.T0109 AI Supply Chain Rug Pull | Our analysis | Not named by the source | A tool or server that changes after approval, known as a rug pull. |
| MITRE ATLAS | AML.T0110 AI Agent Tool Poisoning | Our analysis | Not named by the source | Tool poisoning through hidden instructions in tool descriptions. |
| NIST AI RMF | MAP Map (opens in a new tab) | Source states | MAP 3.5 | Processes for human oversight are defined, assessed and documented. |
| NIST AI RMF | MANAGE Manage (opens in a new tab) | Source states | MANAGE 2.4 | Mechanisms to supersede, disengage or deactivate AI systems whose outcomes are inconsistent with intended use, which an agent shutdown provides. |
Tools in this layer (26)
Tools whose category is Agent & MCP security, listed by name. Compare them with Coverage Scores on the Agent security hub.
agentgateway (a Series of LF Projects, LLC) · open-source proxy for agent, MCP and LLM traffic
5,472 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026Open sourceApache-2.0Akto · AI agent and MCP security platform
1,532 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceMITAmazon Bedrock AgentCore Policy
Amazon Web Services · managed policy engine for agent tool calls
CommercialCisco (Astrix Security) · agent and non-human identity security platform
CommercialCisco · open-source governance layer for coding agents
888 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026Open sourceApache-2.0Cisco · open-source MCP server scanner
1,096 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceApache-2.0Cisco · open-source scanner for AI agent skills
2,620 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceApache-2.0Cloudflare · managed MCP portal in Cloudflare One
CommercialDocker · open-source container gateway for MCP servers
1,612 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceMITGoogle Cloud · managed agent traffic gateway on Google Cloud
CommercialIBM · open-source MCP and A2A gateway and registry
4,676 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceApache-2.0Snyk (Invariant Labs) · rule-based guardrail layer for agents and MCP
472 GitHub stars as of Oct 21, 2026; last push Jan 12, 2026Open sourceApache-2.0Kubernetes SIG Apps · Kubernetes sandbox for isolated agent workloads
4,347 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026Open sourceApache-2.0Lasso Security · open-source plugin gateway for MCP servers
396 GitHub stars as of Oct 21, 2026; last push Jan 22, 2026Open sourceMITTrail of Bits · MCP security wrapper with server pinning
226 GitHub stars as of Oct 21, 2026; last push Apr 14, 2026Open sourceApache-2.0Snyk (Invariant Labs) · MCP server and agent skill security scanner
3,161 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceApache-2.0 Now Snyk Agent ScanMicrosoft Agent Governance Toolkit
Microsoft · open-source agent governance and policy toolkit
6,454 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceMITNeuralTrust · agent gateway and runtime security platform
15 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026Open sourceApache-2.0 FreemiumNVIDIA · open-source runtime for sandboxed AI agents
17,031 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026Open sourceApache-2.0Cyera (Oasis Security) · non-human identity and agent access platform
CommercialOperant AI · runtime security platform for AI, agents and MCP
CommercialPillar Security · AI agent security platform
CommercialStraiker · agent discovery, testing and defense platform
CommercialAmazon Web Services · open-source sandbox engine for AI agents
451 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026Open sourceApache-2.0ServiceNow (Veza) · AI agent identity security product
CommercialZenity · AI agent security and governance platform
Commercial
Also cover this layer (12)
Our analysis Tools from other categories that document a capability in this layer. Each row names the layer the tool belongs to first and the documented capability our placement rests on.
| Tool | Its primary layer | How it applies | Based on |
|---|---|---|---|
| Azure AI Content Safety | L6 Runtime | Documents a task adherence API that checks how an agent uses its tools. | Detects agent tool use that is misaligned, unintended or premature with the task adherence API |
| CalypsoAI (F5 AI Guardrails) | L6 Runtime | Documents blocking of unauthorized tool calls by agents. | Enforces guardrails on agent actions and tool use and can block unauthorized tool calls |
| Cisco AI Defense | L6 Runtime | Documents allow and block lists for MCP tools. | Enforces tool allowlists and blocklists on MCP traffic |
| CrowdStrike Falcon Guardian | L8 Monitoring | Documents a policy that sets which AI agents may run on managed endpoints. | Defines which AI agents may run on managed endpoints and turns AI governance policy into enforceable controls |
| IBM Granite Guardian188 GitHub stars as of Oct 21, 2026; last push Oct 16, 2026 | L6 Runtime | Documents flags for wrong tool names or arguments in agent workflows. | Flags function-calling hallucinations such as wrong tool names or arguments in agent workflows |
| Lakera Guard | L6 Runtime | Controls which tools an agent can call at runtime with an allow and deny list. | Controls which tools an agent can call at runtime with a tool allow and deny list |
| Meta Llama Protections4,444 GitHub stars as of Oct 21, 2026; last push Oct 12, 2026 | L6 Runtime | Documents AlignmentCheck, which audits agent reasoning to catch goal hijacking. | Audits agent reasoning for goal hijacking with the LlamaFirewall AlignmentCheck module |
| Nightfall AI | L5 Data | Documents an MCP gateway that approves servers and enforces policy on tool calls. | Approves needed MCP servers, blocks the rest by default and enforces policy on every tool call |
| Noma Security | L2 Discovery | Documents runtime approval or blocking of agent tool calls under policy. | Sets a baseline of allowed agents, MCP servers and skills, approves or blocks tool calls, and scopes policies by user, IdP group or tool sensitivity; Judges each agent action in context at runtime and can block it, mask sensitive data, steer the agent, bring in a human or trigger a killswitch |
| NVIDIA NeMo Guardrails7,341 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026 | L6 Runtime | Documents execution rails that check tool calls. | Validates tool inputs and outputs around tool calls (execution rails) |
| Prompt Security | L6 Runtime | Documents least-privilege access controls for agents. | Governs what agents can access and which actions they can take, with least-privilege scope |
| WitnessAI | L5 Data | Documents enforcement of approved MCP servers and tools. | Sets rules by team, job function and purpose, and enforces approved MCP servers and tools; Enforces organization-level bans on MCP servers and tools at the network for every agent, with an audit record for each blocked call |
Gaps we can see
- No tool in this directory documents signing or mutual authentication of agent-to-agent messages, which is the gap against OWASP ASI07 Insecure Inter-Agent Communication.
What this layer will not do
Access controls limit what an agent can do, not what it is told. They do not screen the content of prompts or tool output (layer 6), and an allowed tool can still be misused inside its scope, so scopes must be narrow and actions logged. Scanning an MCP server checks it at the time of the scan; pinning and repeat checks catch later changes. The OWASP LLM06 page says logging, monitoring and rate limits do not prevent excessive agency but can limit the damage, so this layer and layer 8 work together.
Related guides
Agent and tool access FAQ
What is excessive agency?
OWASP's LLM06 risk: an LLM system takes damaging actions because it has excessive functionality, excessive permissions or excessive autonomy. Its prevention list starts with minimizing extensions, their functions and their permissions, running extensions in the user's context, requiring user approval and complete mediation in downstream systems. Those are the controls on this page.
Do we need an MCP gateway?
Our analysis: if agents connect to MCP servers you did not write, a gateway or proxy gives you one place to allow or deny servers and tools, pin approved versions and log tool calls. With a few internal tools and no third-party servers, least-privilege credentials and approval steps in your own code may be enough to start.
How do we stop an agent that goes wrong?
Plan it before launch. NIST AI RMF MANAGE 2.4 asks for mechanisms to supersede, disengage or deactivate AI systems whose outcomes are inconsistent with intended use, and MITRE ATLAS lists Human In-the-Loop for AI Agent Actions as a mitigation. Our analysis: that means a policy engine that can block an action, credentials you can revoke and a named person who may shut the agent off.
Framework sources & last reviewed
OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)
- genai.owasp.org/llm-top-10 checked
OWASP LLM01:2025 Prompt Injection (1 sources)
OWASP LLM02:2025 Sensitive Information Disclosure (1 sources)
OWASP LLM03:2025 Supply Chain (1 sources)
OWASP LLM04:2025 Data and Model Poisoning (1 sources)
OWASP LLM06:2025 Excessive Agency (1 sources)
OWASP LLM07:2025 System Prompt Leakage (1 sources)
OWASP LLM08:2025 Vector and Embedding Weaknesses (1 sources)
OWASP LLM10:2025 Unbounded Consumption (1 sources)
OWASP Top 10 for Agentic Applications for 2026 (resource page) (1 sources)
OWASP Top 10 for Agentic Applications 2026 (PDF, December 2025) (1 sources)
- genai.owasp.org/download/52117 checked
MITRE ATLAS (ids and names from the published ATLAS data file, version 2026.09) (1 sources)
- atlas.mitre.org checked