Agentic AI Gateways & Access Topology
The same identity truth that governs humans now governs agents, LLMs, and tools. Three gateways — agentgateway (MCP/A2A), Envoy AI Gateway (LLM), and Cisco Secure Access (ZTNA) — mediate every agent→tool, agent→model, and user→app call, and every one of them is bound to an accountable human owner. Add a capability by speaking the gateway's protocol, not by wiring a bespoke connector — and revoke it in real time from the same signal bus that governs people.
Three planes, one identity
The fabric already splits into a slow, governed provisioning plane and a fast, event-driven signaling plane. Agentic AI adds a third: a mediation plane where gateways broker every agent/model/tool call — authorized against the same directory that provisions humans.
SCIM 2.0
Who has what. HRIS → IGA reconcile → ITSM change gate → grant/revoke on Duo, AD/Entra, PACS — and now agent identities into Duo Directory.
SSF — CAEP / RISC
What just changed. One VIGIL transmitter, many receivers; each re-evaluates live. A session-revoked event reaches Duo, CII, PACS — and the gateways — at once.
MCP · A2A · LLM · ZTNA
How agents act. Every MCP/A2A tool call, LLM call, and private-app reach is brokered by a gateway and authorized against the agent's identity and human sponsor.
Topology at a glance
The mediation plane — components
Two of the gateways are open standards the lab already approximates with a live stand-in; the rest are Cisco's agentic-security layer — one of which (Duo Agentic Identity) the lab already runs.
| Component | Role | Open standard / product | Lab today | Status |
|---|---|---|---|---|
| agentgateway | MCP · A2A · HTTP data plane — routes, secures, observes agent↔tool & agent↔agent | OSS · Solo.io → Linux Foundation / AAIF (Cisco-contributed) | Prism MCP gateway (gtown.runprism.ai, 8 nodes) | live stand-in |
| Envoy AI Gateway | LLM traffic plane — token limits, provider routing/fallback, model virtualization | OSS · Envoy / CNCF (Tetrate + Bloomberg, v1.0) | LiteLLM on TITAN (7 models, Duo-gated) | live stand-in |
| Cisco Secure Access | ZTNA private-app access + device trust; Private-App API to grant/revoke apps | Cisco SSE (ZTNA/SWG/CASB) · AI-aware SASE | CF Access + Duo at the edge | edge live · API target |
| Duo Agentic Identity | Per-agent identity mapped to a human owner; fine-grained authz at the MCP gateway | Cisco Duo IAM + MCP gateway | Duo Directory SCIM agents + sponsor + scoped token | live |
| Cisco AI Defense | Scans MCP tool + A2A agent registrations for supply-chain threats | Cisco (mcp-scanner · a2a-scanner) | — | roadmap |
| Cisco Identity Intelligence | The intelligence layer above — Oort scores humans; Astrix discovers/governs NHIs + agents; BloodHound Enterprise maps attack paths to Tier Zero | Cisco (Oort = human ITDR · Astrix = NHI · SpecterOps BHE = attack-path APM) | CII risk feed → IGA (live) · Astrix ↔ your NHI registry · BHE ↔ your T0 tier plane | human live · NHI + APM feeds |
| VIGIL SSF/CAEP | Real-time revoke — one signed SET drops the agent's token & its access | SSF 1.0 · CAEP · RISC | ssf-poc :8001/8002/8003 (verified vs CII + caep.dev) | live |
The agent request path
An agent never talks to a tool or a model directly. It presents its Duo Agentic Identity to a gateway, the gateway authorizes the call against Duo's engine (bound to the human sponsor), and only then does the request reach the tool or provider — every hop logged.
flowchart LR
H[Human owner\naccountable]:::h -->|sponsors| A[Agent\nDuo Agentic Identity]:::a
A -->|MCP / A2A| AGW{{agentgateway\n= Prism}}:::g
A -->|LLM call| EAG{{Envoy AI Gateway\n= LiteLLM}}:::g
AGW --> DUO{Duo authz\nallow / block per call}:::d
EAG --> DUO
DUO -->|allow| TOOL[MCP tools\nSplunk · GitHub · Postgres]:::t
DUO -->|allow| LLM[LLM providers\nAnthropic · OpenAI · local]:::t
DUO -.deny.-> X[blocked + logged]:::x
DEF[Cisco AI Defense]:::sc -.scans MCP/A2A on register.-> AGW
classDef h fill:#101b16,stroke:#2c623a,color:#e6edf3;
classDef a fill:#160f22,stroke:#3b3170,color:#e6edf3;
classDef g fill:#1b2838,stroke:#a98f2a,color:#f0f6fc;
classDef d fill:#25161a,stroke:#7a3038,color:#f0f6fc;
classDef t fill:#16202e,stroke:#2c3e57,color:#e6edf3;
classDef x fill:#25161a,stroke:#7a3038,color:#e5534b;
classDef sc fill:#16202e,stroke:#31465f,color:#93a4bb;
How it maps to the three domains
flowchart TB
subgraph EDGE[grayskulltech.com — apex / edge]
CF[Cloudflare zone\n+ tunnels]:::e
ZT[CF Access + Duo\n→ Cisco Secure Access]:::z
end
subgraph LAB[lab.grayskulltech.com — the lab]
DIR[AD · Entra · Duo]:::l
FAB[Identity fabric\nHRIS→IGA→ITSM→CMDB + VIGIL SSF]:::l
GW[agentgateway = Prism\nEnvoy AI GW = LiteLLM]:::g
end
subgraph IDP[identity.grayskulltech.com — portal]
PORT[Fabric portal]:::i
CONS[-lite consoles]:::i
end
CF --> ZT
ZT -->|ZTNA private-app| CONS
ZT --> PORT
FAB -->|SCIM / Admin API| DIR
FAB -->|grant → Private-App API| ZT
FAB -->|CAEP / RISC revoke| ZT
FAB -->|governs| GW
classDef e fill:#16202e,stroke:#2c3e57,color:#e6edf3;
classDef z fill:#1b2838,stroke:#3d6ea5,color:#f0f6fc;
classDef l fill:#16202e,stroke:#2c3e57,color:#e6edf3;
classDef g fill:#1b2838,stroke:#a98f2a,color:#f0f6fc;
classDef i fill:#101b16,stroke:#2c623a,color:#e6edf3;
How it ties to the identity model
Nothing here is a new trust model — it is the fabric's ownership model extended to non-human callers, enforced at a gateway instead of a login form.
| Fabric concept | In the agentic plane |
|---|---|
| Agent = NHI owned by a human | Duo Agentic Identity — each agent maps to an accountable human sponsor; a leaver cascades to the agents they own (re-own or retire) |
| The change gate (ITSM) | A new tool/model/scope for an agent is an RFC — approved, then the gateway policy is updated; nothing self-grants |
| The grant (IGA) | IGA drives Cisco Secure Access Private-App API — who may reach which console is a governed private-resource + ZTNA policy, not a firewall rule |
| The signal bus (VIGIL SSF) | A CAEP session-revoked / assurance-level-change pulls the agent's token at the gateway AND its ZTNA access — one event, both planes |
| Device trust (CMDB + Duo) | Secure Access consumes Duo device trust; CMDB-Lite reconciles the hardware-ID so posture is part of the access decision |
| Identity intelligence (Oort + Astrix + BHE) | Cisco Identity Intelligence becomes two-sided: Oort is the human ITDR (already the fabric's risk feed); Astrix is the non-human side — discover every NHI/agent, bind it to an owner, flag overprivilege, govern its lifecycle. That is the enterprise product for what your taxonomy.psd1 registry + ownership model do by hand. And BloodHound Enterprise adds the attack-path view — which of those owned identities is a path to Tier Zero (your T0 plane) — so you govern by owner and prioritize by exposure. |
Cisco Identity Intelligence is becoming three-sided: Oort (human ITDR), Astrix (non-human / agent), and BloodHound Enterprise (attack-path exposure to Tier Zero) — it discovers, owns, threat-detects, and prioritizes across every population, then feeds the gateways (Duo authz), Secure Access (ZTNA), and VIGIL (SSF revoke). Who (Oort), what (Astrix), and how-they-reach-the-keys (BHE) — the same split your fabric is built on.
Lane: Personal/Lab — Cisco-advisory rehearsal on personal infra, no customer data. The patentable VIGIL CIAF scoring core is Voxiren IP and stays a deferred seam; the gateways and SSF plumbing here are open-standards only.