Security architecture for AI agents: the layers, and the tools that fill them

An agent reads files, calls APIs and changes records, so its security is an architecture question before it is a product question. Vendors now sell AI-specific controls, but their names overlap and their scope differs. This article is a map of the layers, with examples of tools in each, not a buyer's guide.

Start from the layers

• Network edge: inspects traffic to and from AI services and can reveal AI use nobody approved.
• AI gateway: sits between your apps, agents, models and tools, and checks prompts and tool calls.
• Identity and tool scope: each agent has its own identity, narrow tools and approvals for risky actions.
• Detection and response: telemetry from agents, endpoints and identities, with people watching it.
• Pre-release testing: attacks and evaluations that run in CI, before a change ships.

What each vendor says its tool does

• Fortinet describes FortiAIGate as a self-hosted AI gateway for models, agents and MCP tools. It sits between your apps, agents, LLMs and MCP tools, stops attacks and data leaks, enforces usage policy and caps spend. Fortinet says FortiGate sends the AI traffic it detects to FortiAIGate.
• Palo Alto Networks documents a Prisma AIRS MCP server that works by intercepting tool invocations, performing security analysis and returning a verdict on whether a threat was detected.
• CrowdStrike announced in September 2025 an agreement to acquire Pangea, to deliver what it calls AI Detection and Response, applying the endpoint detection and response model to AI. Check the current product and availability with the vendor.
• promptfoo describes itself as an open-source CLI and library for evaluating and red-teaming LLM apps. NVIDIA's garak is an open-source LLM vulnerability scanner. Both can run before release.

How the layers connect

A request enters through the edge, reaches the agent, and every prompt and tool call then passes the AI gateway before it reaches a model or a business system. Telemetry flows to detection and response. Red-team tests and evaluations run in CI, so a change that makes the agent easier to trick is caught before users see it.

Principles that outlast any product

• Assume the model can be tricked, and make sure a tricked model can do little: scoped identities, short-lived credentials.
• Keep control outside the model. Policy, limits and approvals belong in code the model cannot rewrite.
• Keep a human in the loop for risky actions. The MCP specification says there should always be a human able to deny tool invocations.
• Log every tool call with the acting identity so an incident can be replayed.

Questions to ask any vendor

• Which layer does it cover, and which does it leave to someone else?
• Is it self-hosted or a cloud service, and where do prompts and logs go?
• Does it see MCP and agent traffic, or only plain model calls?
• How are its protections tested, and how do they map to the OWASP lists? Treat the vendor's own alignment claims as claims.