Agentic AI Gateways & Access Topology

Topology at a glance

The three gateways mediate agent→tool, agent→model, and user→app traffic; the identity fabric below governs every one of them, and the SSF bus revokes them in real time.

Three planes, one identity

The fabric already splits into a slow, governed provisioning plane and a fast, event-driven signaling plane. Agentic AI adds a third: a mediation plane where gateways broker every agent/model/tool call — authorized against the same directory that provisions humans.

The mediation plane — components

Two of the gateways are open standards the lab now runs live — agentgateway for MCP tools and Envoy AI Gateway for the LLM plane; the rest are Cisco's agentic-security layer — one of which (Duo Agentic Identity) the lab already runs.

The agent request path

An agent never talks to a tool or a model directly. It presents its Duo Agentic Identity to a gateway, the gateway authorizes the call against Duo's engine (bound to the human sponsor), and only then does the request reach the tool or provider — every hop logged.

flowchart LR
  H[Human owner
accountable]:::h -->|sponsors| A[Agent
Duo Agentic Identity]:::a
  A -->|MCP tools| AGW{{agentgateway
MCP · live}}:::g
  A -->|LLM call| EAG{{Envoy AI Gateway
LLM · live}}:::g
  AGW --> DUO{Duo authz
allow / block per call}:::d
  EAG --> DUO
  DUO -->|allow| TOOL[MCP tools
GitHub · MS Learn · Splunk]:::t
  DUO -->|allow| LLM[LLM providers
Anthropic · OpenAI · local]:::t
  DUO -.deny.-> X[blocked + logged]:::x
  DEF[Cisco AI Defense]:::sc -.scans MCP/A2A on register.-> AGW
  classDef h fill:#101b16,stroke:#2c623a,color:#e6edf3;
  classDef a fill:#160f22,stroke:#3b3170,color:#e6edf3;
  classDef g fill:#1b2838,stroke:#a98f2a,color:#f0f6fc;
  classDef d fill:#25161a,stroke:#7a3038,color:#f0f6fc;
  classDef t fill:#16202e,stroke:#2c3e57,color:#e6edf3;
  classDef x fill:#25161a,stroke:#7a3038,color:#e5534b;
  classDef sc fill:#16202e,stroke:#31465f,color:#93a4bb;
    

How it maps to the three domains

flowchart TB
  subgraph EDGE[apex / edge]
    CF[Cloudflare zone
+ tunnels]:::e
    ZT[CF Access + Duo
→ Cisco Secure Access]:::z
  end
  subgraph LAB[the lab]
    DIR[AD · Entra · Duo]:::l
    FAB[Identity fabric
HRIS→IGA→ITSM→CMDB + SSF]:::l
    GW[agentgateway MCP · live
Envoy AI GW = LLM · live]:::g
  end
  subgraph IDP[identity portal]
    PORT[Fabric portal]:::i
    CONS[governed consoles]:::i
  end
  CF --> ZT
  ZT -->|ZTNA private-app| CONS
  ZT --> PORT
  FAB -->|SCIM / Admin API| DIR
  FAB -->|grant → Private-App API| ZT
  FAB -->|CAEP / RISC revoke| ZT
  FAB -->|governs| GW
  classDef e fill:#16202e,stroke:#2c3e57,color:#e6edf3;
  classDef z fill:#1b2838,stroke:#3d6ea5,color:#f0f6fc;
  classDef l fill:#16202e,stroke:#2c3e57,color:#e6edf3;
  classDef g fill:#1b2838,stroke:#a98f2a,color:#f0f6fc;
  classDef i fill:#101b16,stroke:#2c623a,color:#e6edf3;
    

How it ties to the identity model

Nothing here is a new trust model — it is the fabric's ownership model extended to non-human callers, enforced at a gateway instead of a login form.

Cisco Identity Intelligence is becoming three-sided: Oort (human ITDR), Astrix (non-human / agent), and BloodHound Enterprise (attack-path exposure to Tier Zero) — it discovers, owns, threat-detects, and prioritizes across every population, then feeds the gateways (Duo authz), Secure Access (ZTNA), and the SSF bus (real-time revoke). Who (Oort), what (Astrix), and how-they-reach-the-keys (BHE) — the same split this fabric is built on.

Cisco XDR closes the loop. CII gives XDR the identity vector; XDR correlates it with endpoint, network, email, and DNS, raises an identity threat as an incident, and drives the response back down — session-kill / quarantine through Duo, Secure Access, and ISE. In this lab, SIEM detections and the SSF/CAEP bus stand in for that detect → session-revoked loop: the same shape XDR runs at enterprise scale.

Companion view: see the as-built authZ → — the concrete request path and per-tool authorization behind the agentgateway plane.

Lane: personal lab · synthetic data — synthetic identities only, no customer data. The gateways and SSF plumbing shown are open-standards only.