Ask a security team how many AI agents run inside their company and watch the pause. The honest answer comes back as a range, and the range is wide. Agents arrive through a dozen doors: an engineer installs a coding assistant on Tuesday, a product team ships a support bot, somebody wires an internal service to an MCP server over a weekend. Every one of them holds a credential and acts on its own.
Governing them gets awkward fast, because the security stack you already pay for was drawn around a person. Someone signs in, does a bounded set of things, signs out. An agent works nothing like that. It receives its credential once, then runs a loop for hours, pulling in content nobody screened and choosing its next move from whatever it has read so far. Once you look closely at that loop, the whole market for agent security tools becomes much easier to read.
The loop every agent runs
Strip off the branding and each agent repeats the same handful of moves. It starts with an identity, because someone provisioned a token or a service account, and from that moment the agent carries everything that credential can reach. It takes in context next: your task, plus documents, API responses, pages, and tool output picked up along the way, some of it from places nobody vetted. Then it decides, reading the pile of accumulated context and choosing an action.
Then it acts. A file read, a shell command, a database write, an MCP invocation. This is the tool call, and it is the only move in the whole sequence that touches anything real. The result folds back into context and the loop turns again, twenty times or two hundred, however many the task takes. Off to the side, a log catches fragments.
One property of that loop drives everything else. Intent sits on one side of the tool call and consequence sits on the other. Before it, the agent is thinking. After it, something already happened.
Every product clamps onto one point on the loop
The categories on the market today each grab a different moment in that cycle. Their blind spots are not oversights. They follow from where the tool sits.
- Identity and credential platforms work at provisioning, before the loop starts. They decide what the agent gets handed, issue it just in time, and pull it back later. During the thousand decisions the agent makes while holding that credential, they have nothing to say.
- AI gateways sit on the model call in the middle of the loop, which buys you routing, request logs, token accounting, and a budget ceiling. They watch the agent think. The file read and the shell command that follow the thinking never pass through them.
- Runtime detection platforms read the exhaust, matching behavior against injection signatures and anomaly baselines. Their verdict lands after the tool call resolved. On a chain that turns twice a second, an alert is a description of something you can no longer prevent.
- MCP gateways attach at the tool call itself, which is the right place, and give you a server registry, role rules, pre-call checks, and invocation logs. What arrives there is the call on its own, stripped of the reasoning and the earlier context that produced it. A poisoned document read three turns ago yields a request that looks perfectly ordinary by the time it reaches the gateway.
- Red teaming and posture tools run the loop in a lab before you ship and surface weaknesses worth fixing. Production runs a different loop, on data the lab never saw.
Line them up and a shape shows through. The moment an agent stops thinking and starts doing carries the thinnest coverage of any point on the loop, and it happens to be the last moment where stopping something is still an option.
One agent, three places it runs
A loop-only view flattens a second axis worth keeping. Your company runs that same loop in three different environments, and a control built for one of them cannot see into the others.
- On developer machines. Claude Code, Cursor, Codex, and Copilot CLI run beside your source tree, your local credentials, and a live shell.
- Inside production services. LangChain, CrewAI, and the OpenAI Agents SDK run the loop in process, inside code paths you wrote and deployed.
- Across the tool layer. Any agent that reaches an MCP server or loads a skill inherits whatever that server or skill can touch.
Most governance projects pick one environment and call the job done. A rule that keeps a developer’s coding agent away from production, while the LangChain service behind your API reaches it freely, is a rule with a hole shaped exactly like your production traffic.
How Prismor approaches it
Prismor puts its control at the tool call and runs one policy across all three environments. For coding agents, it hooks the tool execution cycle, so a call gets evaluated on the way out instead of described afterward. For production frameworks, an in-process adapter wraps the framework’s own tool execution with that same engine, so a single rule covers an engineer’s laptop and the pipeline serving your customers. At the tool layer, an MCP gateway consolidates downstream servers behind one enforcement point with pre-call checks and complete invocation logs. Policies live in version control and get pulled like any other configuration.
Sitting at the call with the session’s history in hand opens up a few things a single-point tool cannot reach.
- Combination rules. The engine remembers what a session already touched, so it can stop the pattern where an agent reads untrusted content and then reaches for a shell, catching it before that second call executes.
- Step-up approval. Production writes, outbound calls, and code pushes halt the loop and wait for a person to say yes.
- Supply chain checks. Skills and MCP servers get matched against known-vulnerability data, with typosquat detection and schema-drift monitoring that catches a server changing shape under you, plus a sweep for agents and servers nobody registered.
- Signed audit. Each action ties back to a named agent and the human it answers to, in a tamper-evident trail that yields evidence an auditor accepts.
Mapped back onto the loop, that reaches every point on it: the credential at the start, the context and combinations through the middle, enforcement at the call itself, and a record at the end that somebody can read six months later.
Count before you buy
Write down every coding agent on every developer machine, every agent running inside a production service, and every MCP server and skill any of them can reach, each one tied to the human or service it answers to. Teams that do this usually find the list runs longer than expected and that nobody owns a third of it. Every control you pick afterward is guesswork until that list exists.
Then put a single question to whatever you are evaluating. When an agent reaches for something it should never touch, does this stop the call, or does it tell me afterward? Both answers have a place in a security program. Only one of them changes what happens next.