Back to API Bites
The risk profile of enterprise AI changes dramatically between pilot and production. It is one thing to experiment in a sandbox; it is another to let AI agents reach into enterprise tools, internal data sources, and operational systems. That is why the newly released Model Context Protocol (MCP) Companion Guide from the Center for Internet Security matters. Published by CIS on 20 April 2026 and announced the next day in a joint press release with Astrix and Cequence, the guide arrives at the exact moment enterprises need practical governance for agentic AI.
Why MCP Creates a New Enterprise Security Boundary
In no small measure, MCP has become the connective tissue between AI and the rest of the enterprise. CIS describes MCP as an open standard that allows AI systems to interact consistently with external tools, data sources, and services through a common, interoperable framework instead of proprietary, model-specific integrations. It also makes discovery, invocation, and logging more predictable across models and platforms. In plain English, MCP gives enterprises a standard way to connect AI to real systems instead of building one-off integrations for every tool and model combination.
That standardization is exactly why governance now matters so much. Once AI systems can call tools, retrieve information, read structured documents, and interact with systems, the protocol layer becomes a control point. CIS is explicit about this: the MCP Companion Guide applies CIS Controls v8.1 to MCP-based systems and notes that MCP expands identity, access control, logging, and application security surfaces by formalizing how AI systems discover and invoke privileged capabilities. For enterprises, that means MCP is not just a developer convenience. It is a new and distinct security boundary that needs policy, oversight, and operational discipline.
What Are the Security Risks of AI Agents Accessing Enterprise Tools?
Before examining how the new Guides help govern AI, it is worth naming some of the more significant threats they address. As AI agents move into production workflows, enterprises face a distinct class of risks that traditional security controls were never designed to catch:
Rogue MCP servers. Attackers can register malicious MCP servers that mimic legitimate tools, causing agents to exfiltrate data or execute unauthorized actions without the user’s knowledge.
Unbounded agent autonomy. Without explicit tool-level constraints, an agent with valid credentials can pivot across systems far beyond its intended scope, turning a narrow task into a broad data access event.
Credential and token misuse. AI agents authenticate using OAuth tokens, API keys, and service accounts. Without session binding and token lifecycle management, stolen credentials give attackers persistent access that looks like legitimate agent behavior.
Sensitive data leakage through MCP responses. An MCP server that returns tool results containing PII, credentials, or financial data exposes that information to the agent’s context window, where it can be logged, transmitted, or surfaced in model outputs.
Prompt injection via tool responses. A compromised data source can inject malicious instructions into an MCP tool response, hijacking an agent’s subsequent actions within the same session.
Lack of auditability. Without protocol-level logging, security teams cannot answer the questions that matter after an incident: which agent accessed which system, which tool it called, what data it retrieved, and what action it took.
Five Ways the Guide Helps Enterprises Govern Agentic AI
1. Making AI Tool Access Explicit and Governable
The first big way this guide helps enterprises is by making AI-to-tool access governable. CIS says MCP is built around explicit permissions, clear interface contracts, and auditable actions, with each capability granted individually rather than through broad or opaque access. That is a major shift from the loose, experimental posture many organizations still have around AI. Instead of asking whether an agent can “connect,” enterprises can define what it may connect to, what it may retrieve, which tools it may invoke, and what actions it may execute. That is the foundation of real governance.
2. Extending CIS Controls to AI-Driven Architectures
The guide gives enterprises a practical path without forcing them to adopt yet another framework. The new companion guides adapt the CIS Controls to AI-driven architectures and provide clear, prioritized recommendations across development, deployment, and operational phases. That matters because most security and IT teams do not need more abstract theory. They need a way to extend controls they already understand into systems that behave differently from traditional software. By anchoring MCP governance in CIS Controls, the guide lowers the friction between innovation and enterprise security.
3. Governing Non-Human Identities at Scale
The MCP guide emphasizes secure tool access, management of non-human identities, and auditable interactions across the protocol layer. It also highlights the risks enterprises are already facing as AI moves into production workflows, including data leakage, unbounded agent autonomy, credential misuse, and unsafe or inappropriate execution of tools. That is a useful reality check. In an MCP environment, the identity problem is no longer limited to employees and administrators, but now includes agents, connectors, API keys, service accounts, and OAuth tokens that allow AI systems to reach enterprise resources. However, identity, while critical, is insufficient for limiting AI agent tool access. The principle of least privilege must also be applied to agents.
4. Building Auditability and Visibility Into the Protocol Layer
MCP improves auditability and makes integration behavior more predictable, but only when we reliably generate auditable interactions at the protocol layer. For enterprises, that has immediate value. It means security and compliance teams are in a better position to answer the questions that matter after an incident or during a review: Which agent accessed which system? Which tool was called? What data was requested? What identity or token was used? What action was taken? Enterprise AI programs lose momentum fast when those answers are unavailable or unpalatable. Governance that improves traceability helps organizations move faster with more confidence.
5. Framing AI Security as a Stack, Not a Point Problem
Three new companion guides were released, spanning Large Language Models, AI Agents, and MCP integrations, covering everything from prompts and context handling to safe tool execution and protocol-level access. That broader framing matters because enterprise AI risk does not live in one layer. It spans model behavior, agent autonomy, and system integration. The MCP guide is especially valuable because it addresses the moment when AI stops being a chatbot and starts becoming an operator inside business systems. That is where governance must become enforceable, not aspirational.
The bottom line is straightforward: enterprises cannot scale agentic AI safely without governing the protocol layer that connects models to tools and data. The new CIS MCP Companion Guide helps by bringing structure to that problem. It gives organizations a standards-based way to define permissions, govern non-human identities, improve auditability, and apply familiar controls to a new class of AI-enabled interactions. While it will not eliminate every risk in enterprise AI, it does give security and IT leaders something they need right now: a credible framework for enabling agentic AI access without surrendering visibility, control, or trust. After all, with a proper foundation, agentic AI can be deployed rapidly and safely.
How Cequence Supports the CIS MCP Framework
The CIS MCP Companion Guide defines what enterprises should do; the Cequence AI Gateway operationalizes it. The guide calls for explicit permissions and individual capability grants rather than broad agent access. AI Gateway enforces this through Agent Personas: security teams describe an agent’s job in plain English, and the gateway automatically generates a least-privilege permission set that restricts the agent to only the tools, endpoints, and data sources it needs. An agent provisioned to retrieve customer records from Salesforce cannot pivot to execute actions in Jira. That boundary holds at the protocol layer, not just in policy documentation.
The guide emphasizes governance of non-human identities and auditable interactions across MCP. AI Gateway handles both through OAuth 2.1-compliant identity integration and session binding protection, which locks authenticated tokens to originating IP addresses to prevent credential reuse. Every AI-to-API interaction generates a full audit log recording which agent acted, which tool it called, which data it accessed, and what it returned.
The guide highlights sensitive data exposure as a primary production risk. AI Gateway applies DLP scanning to both agent requests and MCP server responses, with more than 100 out-of-the-box detection types covering PII, credentials, financial data, and health records. Security teams can monitor, redact, or block exposure in real time without changing application code.
The guide warns against rogue MCP servers. AI Gateway eliminates this risk by providing a trusted server registry: only vetted, officially configured MCP servers appear in the catalog. Teams cannot connect agents to arbitrary or shadow MCP endpoints.
Cequence co-announced this guide with CIS and Astrix because the alignment is direct: the guide defines the governance standard, and AI Gateway delivers the enforcement layer that makes that standard operational at enterprise scale.
We welcome the opportunity to have a no-pressure chat to show you how the Cequence AI Gateway offering provides enterprises much-needed security, governance, and scale.
