Every tool call, every user: Real-time authorization with SailPoint and Google Agent Gateway

AI agents are rapidly evolving from passive responders to autonomous actors. Instead of just answering questions, they now query databases, modify sensitive records, and invoke tools across Model Context Protocol (MCP) servers on behalf of human users. While foundational platform controls restrict which agent can connect to which server, enterprise security demands much finer-grained governance: enforcing dynamic policies that determine exactly what an agent can do, when and why it can do it, and who authorized the action in the first place.

Google’s Agent Gateway identifies which agent is initiating a call and verifies destination reachability. SailPoint enriches that traffic with enterprise identity context: establishing clear human ownership, continuously tracking permissions across agent lifecycles, and evaluating what the agent is permitted to execute based on fine-grained access policies defined at the organizational level. Because these policies are rooted in core identity governance, agent tool permissions can be audited and certified alongside any other enterprise entitlement.

Google Agent Gateway provides the central enforcement point for agent traffic, while its service extension model allows partner authorization engines to inspect requests in real time. SailPoint built an authorization service directly onto that extension point. For every tool call, it verifies the delegated user’s identity, calls SailPoint Agentic Fabric to determine whether the agent's intended action complies with enterprise policy, and returns an explicit allow or deny verdict to the gateway before the call reaches the MCP server. Policies are managed centrally in SailPoint Agentic Fabric, default to deny, and each decision is recorded with complete audit context.

Problem Statement: Enforcement without deep identity context has gaps

An enterprise AI agent rarely operates on behalf of just one user. Deployed once, a single agent may serve an entire organization, assisting users across multiple departments with differing roles, clearance levels, and entitlements. Google’s Agent Gateway establishes the foundational security perimeter by authenticating the agent and verifying host reachability. To complement runtime enforcement, organizations must also evaluate deep authorization context:

1. Granular Human and Organization Context: Authorization must extend beyond coarse connectivity. For example, rather than simply determining whether an agent can access a CRM, policies evaluate the calling user's department, the designated human owner of the agent, and field-level permissions within the CRM.
2. Differentiated Tool Sensitivity: A single MCP server often exposes everything from read-only lookups (e.g., check_status) to state-changing transactions (e.g., update_record or approve_transfer). These disparate actions require distinct, fine-grained evaluations rather than an all-or-nothing permit.
3. Governance over agent credentials: Real-time authorization verifies whether credentials used by the agent are properly vaulted, governed, and isolated, preventing secrets exposure during tool execution.
4. Dynamic Identity Lifecycles: Static allowlists struggle as people join, transfer roles, or leave. Security teams need runtime decisions tied to their existing identity governance program, defaulting to deny, with an immutable record of every action.

The solution: Agent Gateway enforces, SailPoint decides

In the Agent-to-Anywhere (egress) setup, every outbound call an Agent Engine agent makes to an MCP server passes through the gateway. Identity-Aware Proxy (IAP) checks that the agent may reach the host. A service extension then lets a partner inspect the request, including which tool is being called, and return a decision. The gateway acts on that decision, so enforcement happens in one consistent place and with no changes to the agent or the MCP server.

Where SailPoint fits. SailPoint supplies two pieces. The first is an authorization service, an Envoy external processor, which the gateway calls for each tool call. It verifies the user's token, reads the tool name and passes the request to the second piece: the policy decision point (PDP) in SailPoint Agentic Fabric, where administrators manage the authorization policies. SailPoint Agentic Fabric answers allow or deny, and the gateway enforces it. Because SailPoint Agentic Fabric policies are rooted in human and non-human identity context, agent access follows human context governance. Access policies can also be reviewed and certified alongside every other entitlement, a level of governance that gateway-only authorization tools can’t easily match.

Step by Step Flow:

1. Authentication & Token Issuance: An end user signs into an application through your enterprise Identity Provider (IdP) and receives an authenticated access token representing their identity and granted scopes.

2. Delegation & Tool Call Dispatch: When the user prompts the agent to perform a task that requires interacting with external systems, the application provides the user's access token to the agent. Rather than impersonating the user or operating under an unconstrained service account, the agent supplies the user's access token directly alongside its outbound tool call to the Model Context Protocol (MCP) server.

3. Gateway Interception & Perimeter Check: The outbound request routes through Google Agent Gateway. The gateway identifies the invoking agent via its workload identity, confirms that the agent is permitted egress to the target MCP host, and makes the call to SailPoint’s Policy Decision Point (PDP) for an access policy decision before it leaves the security perimeter.

4. Deep Policy Evaluation in SailPoint Agentic Fabric: The authorization service queries SailPoint Agentic Fabric presenting the complete operational context:

• Who is asking? (The verified end-user identity and their organization entitlements).
• Who owns and operates the agent? (The agent workload identity and human owner).
• What action is being attempted? (The specific MCP tool function, target server, and argument payloads).
• Under what conditions? (Departmental clearance, role-based guardrails, and temporal rules).

SailPoint Agentic Fabric checks these parameters against organization-level fine-grained policies and renders an explicit ALLOW or DENY verdict with audit rationale.

5. Deterministic Runtime Enforcement:

• On Allow: The gateway releases the paused request, forwarding it directly to the MCP server. The tool executes, and the MCP server returns the result back through the gateway to the agent.
• On Deny: The call stops dead at the gateway. The target MCP server never receives or processes the request. The gateway returns a structured error to the agent containing a SailPoint Agentic Fabric authorization reason code, preventing unauthorized data access or mutation.

Real-time enforcement at the Google Agent Gateway, fine-grained deep access policy decisions through SailPoint. The gateway provides the real-time enforcement point, and SailPoint Agentic Fabric provides the fine-grained authorization decision logic. For every tool call, SailPoint Agentic Fabric evaluates the verified end user and their entitlements, the agent acting for them, the tool and MCP server being reached, and the gateway in use. Anything not explicitly allowed is denied, and every decision is audited with its reason. Policies live once in SailPoint Agentic Fabric and extend to additional gateways without being rebuilt.

Customer Outcomes: Securing Autonomous Execution at Scale

• Precise, Field-Level Tool Governance: Organizations can enforce field- and parameter-level restrictions, preventing shared multi-tenant agents from overreaching or executing unauthorized state-changing operations.
• Continuous, Lifecycle-Driven Authorization: Eliminate stale permissions and standing privileges. Because decisions are evaluated per tool call against enterprise identity governance, agent permissions synchronize dynamically with real-time human and non-human status—immediately neutralizing unauthorized access during role changes, reassignments, or departures.
• Maintain Centrally Governed Access Policies: Author governance policies once in SailPoint Agentic Fabric and enforce them through Google Agent Gateway. Organizations achieve unified compliance posture and a consolidated audit trail without fragmented policy silos.
• Minimize Developer Friction or Agent Refactoring: Implement non-intrusive runtime governance without imposing a "security tax" on development teams. Application engineers continue writing agents and deploying MCP servers using open protocols, while policy enforcement occurs transparently at the gateway layer.
• Audit Readiness & Enterprise Scaling Confidence: Provide security, risk, and compliance leaders with continuous auditability, periodic manager certifications, and separation-of-duties (SoD) enforcement. Organizations can confidently expand agentic AI initiatives knowing autonomous actions remain accountable to human ownership and governance controls.

Conclusion

As agents take on more work, the question shifts from what an agent can reach to what it is allowed to do through it. Google Agent Gateway provides a consistent, real-time enforcement point, and SailPoint adds the identity-aware fine-grained authorization decision behind it. Together they let organizations adopt agents quickly while keeping access tied to who is asking.

To learn more about securing AI agents with SailPoint, contact your SailPoint representative.