Secure paved road · 02 of 10 · Tool gateway

MCP tool gateway: the only road to infrastructure

Agents never hold infrastructure credentials. The gateway validates the call, asks policy, mints a scoped token for that one call, and records it. Direct routes stop at the boundary.

MCP tool gateway: the only road to infrastructure Architecture with three trust zones: an untrusted agent sandbox, a governed gateway zone containing policy decision, audit and credential broker, and protected infrastructure and secrets, showing permitted MCP calls through the gateway and two direct routes that are denied at the boundary. UNTRUSTEDGOVERNED · GATEWAYPROTECTEDDIRECT TO INFRA · DENIEDDIRECT TO SECRETS · DENIEDMCP CALLAUTHZ?ALLOWEVERY CALLSCOPED TOKENFETCHCoding agentClaude Code · CursorTool gatewayMCP · schema-validatedPolicy decisionOPA / CedarAudit logappend-only · WORMCredential brokerper-call, short-livedInfra APIsk8s · ArgoCD · Git · cloudSecrets storenever reaches the agentOne privileged gate. Everything else is a route to it.LEGENDPrivileged gateCredential mintRecordGoverned callInternalDenied route

Problem

Agents have to reach infrastructure through governed interfaces, never through ad hoc credentials.

Risk tiers, enforced here

  • T0 read-only: auto-approved.
  • T1 reversible writes (PRs, dev sync): auto-approved, audited.
  • T2 prod-affecting: human approval or pre-approved runbook.
  • T3 (secret reads, IAM, pod exec): never exposed.

Evidence and gap

Built in Hangar: Tower write-action policy (delegated vs interactive, lower-env only, authz required for prod RBAC) and never-persisted credentials. Proposal only: a general MCP gateway with OPA or Cedar policy.

Hangar · reference architecture