Agents should reach company systems only through one authenticated, audited gateway

Harish Gaggar, who works at Intuit Credit Karma, argued that company AI agents should never connect straight to the systems they use. On the AI Engineer show, he described one gateway that every request must pass through. The gateway checks who is asking and which tool they may use.

What was said

Gaggar's setup is built on MCP, a common standard that lets AI agents call tools. An agent or coding assistant first sends a one-time sign-in request to the gateway. The gateway stores the session and hands back a token, a digital pass. Each tool request then carries that token. The gateway reads it, works out which tool server is meant, and forwards the request with the user's identity attached. The tool server calls the real service and returns only what that user is allowed to see. The tools themselves are limited too. Gaggar said every tool on an MCP server must be fully reviewed by the company's own security team before it goes live. That lets the company filter requests, set limits and block data fields the AI model should not receive. He was blunt about the rule. A speaker on the show said: "There should not be direct access provided um on any endpoints." He also described the watching layer. Logs, traces and metrics show which tool is slow, where errors happen and when rejected sign-ins spike.

Why it matters

Our reading: this turns agent access from many separate connections into one place that can be inspected. If every call crosses the same gateway, a security team can ask who called what, and what was refused. That is hard to do when each agent has its own route to its own systems. For managers and buyers, the practical test is simple. Can your team list every tool an agent may use? Was each one reviewed? Does each call carry a real user or service identity? Gaggar's list also includes auditing of tool use and a human in the loop for high-risk actions.

The other side

The excerpts describe one company's design. They give no results showing how many incidents the gateway prevented, or how much the review and monitoring work costs. The gateway also confirms identity and approved tools. It does not judge whether an allowed action is wise. Gaggar's answer was to keep a human in the loop for every high-risk item, which adds people and time. The excerpts do not say what happens if the gateway itself fails or becomes a bottleneck. He also noted that teams in air-gapped environments, cut off from outside networks, may need to build their own gateway. So this is a design to build and run, not something to switch on.