Why advisory controls fail
Many governance products evaluate policy near the agent. That can be useful, but it remains advisory if the agent or surrounding system can still reach the target API another way.
A control only becomes hard when the network path itself goes through it. That is the job of the execution gateway.
What a network boundary enforces
Because the gateway sits in front of the target API, it can enforce the same sequence on every protected call.
- Permit verification: signature, expiry, and single-use checks happen before forwarding.
- Credential mediation: downstream credentials are retrieved at forward-time, not held in the runtime.
- Exact forwarding: the gateway forwards the request that was actually approved.
- Receipt capture: the execution path produces a structured record of what happened.
Why this changes the risk model
The question stops being "did the agent behave?" and becomes "could the system have executed without passing the boundary?" That is a much stronger security property.
A network-enforced boundary reduces bypass risk, removes raw downstream secrets from the runtime, and makes the control plane relevant at the exact moment the mutation happens.