ServiceNow added MCP runtime enforcement. Rubrik embedded OWASP-aligned guardrails. Microsoft introduced a firewall that discovers and controls MCP server usage at the network level. Three enterprise vendors, one week, same architectural choice: governance at the protocol layer.
The visible story is Model Context Protocol (MCP) adoption. The hidden story is where policy enforcement lands. Infrastructure vendors are no longer treating MCP as a simple connectivity protocol — they are making it the control plane where enterprise AI agents hit their limits.
The Three Vendors #
On September 10, ServiceNow shipped AI Gateway v3.4, adding MCP runtime enforcement with server lifecycle management. The update allows organizations to define which MCP servers an agent can discover, which tools it can invoke, and which resources it can access — all enforced at the gateway layer rather than at the model or application level.
Five days later, Rubrik launched Rubrik MCP, co-engineered with Anthropic. The data-security vendor’s implementation goes further than simple connectivity: it embeds OWASP MCP Top 10-aligned guardrails directly into the protocol layer, replacing static API keys with scoped, short-lived tokens minted per tool call. Rubrik Agent Identity federates with Okta and Microsoft Entra ID, enforcing RBAC parity between agents and human users.
On September 17, Microsoft expanded Entra Agent ID with an MCP Firewall — a component of its Global Secure Access suite that sits directly in the communication path between agents and their tool ecosystems. The firewall discovers MCP servers in use, blocks unknown or unauthorized ones, and enforces granular policies on specific MCP methods.
Why the Protocol Layer #
The choice to embed governance at the MCP layer rather than at the model or application layer is architecturally significant. When enforcement lives in the model, it constrains what the AI says. When it lives in the application, it constrains what the UI shows. When it lives in the protocol, it constrains what the agent can actually do — regardless of which model powers it or which interface presents it.
This is infrastructure-level policy. The agent cannot exceed what the MCP layer permits. ServiceNow controls server lifecycle. Rubrik controls data access and credential scope. Microsoft controls network-level discovery and traffic. Each vendor chose the same enforcement surface, but applied different governance domains to it.
The Stack Formalizes #
These three moves extend the agent governance stack that has been forming over the past two weeks. Cisco’s Agent Runtime SDK embeds policy at build time — constraints compiled into the agent before it reaches production. NVIDIA OpenShell and WSO2 Agent Manager provide runtime sandboxing and control planes. Rubrik now occupies data security. Microsoft adds network-level enforcement.
The governance stack now spans four layers: build-time (Cisco), runtime (NVIDIA, WSO2), data-security (Rubrik), and network (Microsoft). No single vendor owns all four. Enterprises will assemble from multiple vendors — and the MCP protocol is becoming the surface where all four layers converge.
The Shadow Problem #
The MCP Firewall’s discovery capability addresses what Microsoft calls “shadow AI” — unauthorized MCP servers integrated into enterprise workflows without IT oversight. This connects to the broader governance gap documented in Okta’s 2026 survey: 67% of workers use unapproved AI tools while 92% of executives report autonomous agents in widespread use.
The firewall’s default-deny option forces a “known-good” environment where shadow servers can be identified and blocked. This is the first network-level mechanism designed specifically for MCP traffic — not generic application-layer filtering, but protocol-aware enforcement that understands what an agent is trying to do at the tool level.
What to Watch #
The convergence of three vendors onto the same protocol layer in one week suggests MCP is evolving from a connectivity standard to a control plane. The open question is whether this creates fragmentation — three different enforcement models on the same protocol — or convergence toward a shared governance baseline.
For builders deploying agents across enterprise environments, the practical implication is clear: MCP is no longer optional infrastructure. It is becoming the surface where enterprise security policy meets agent capability. The vendors that control this layer control what agents can actually do — regardless of which model, framework, or interface sits above it.