The News
Datawiza, a vendor specializing in identity-aware application security, has announced Agent Gateway, a new enforcement layer designed to bring zero-trust governance to enterprise AI agents. The product sits between AI agents and the enterprise systems they access, evaluating identity, policy, and context before any request proceeds. It supports connections over APIs, Model Context Protocol (MCP), and Agent2Agent (A2A) protocols, and integrates with identity providers including Microsoft Entra ID and Okta, with deployment options spanning on-premises, customer-managed cloud, and Datawiza-hosted environments.
Analyst Take
The gap AI agents are about to fall through
Enterprise AI adoption has followed a familiar pattern: speed of deployment outpacing speed of governance. Pilots become production workloads before anyone has formalized who, or what, is authorized to act on behalf of the organization. That’s precisely the exposure Datawiza is targeting. The problem isn’t that enterprises lack identity infrastructure. Most have mature IAM stacks. The problem is that AI agents operate outside the perimeter those stacks were built to govern. They don’t log in. They hold shared API keys and service accounts. They can retrieve records, update data, and trigger workflows across SAP, Oracle ERP, and HR systems, often without leaving a trail that connects the action back to an initiating human or authorized policy.
This is an access governance problem, not an AI problem. Datawiza’s framing is smart: rather than positioning Agent Gateway as a new AI product, the company is positioning it as an extension of zero-trust principles into the agent runtime. That argument will land with security and IAM teams who are already under pressure to account for non-human identities in their audit posture.
Why this matters more for enterprises than for hyperscalers
The technical architecture here deserves attention from platform and DevSecOps teams. Agent Gateway inserts itself into the request path, performing identity resolution, policy evaluation, and credential injection before an agent reaches a backend system. Downstream credentials, including OAuth tokens and API keys, never travel with the agent. They’re brokered at runtime. That’s a meaningful architectural distinction from simply rotating secrets or scoping service accounts manually. It means the agent itself becomes a less sensitive artifact, which reduces blast radius if an agent workflow is compromised or misconfigured.
The integration targets (SAP, Oracle ERP, HCM platforms) are telling. These are not greenfield cloud-native systems. They are exactly the category of application where ECI Research’s Google GovTech Survey found that 26.0% of respondents identified “Securing machine-to-machine secrets management and API tokens” as their biggest hurdle when implementing Zero Trust at the application layer. Agent Gateway may be a direct answer to that pain point, applied specifically to the agent use case, which adds another layer of complexity because agents can chain requests across multiple systems in a single workflow.
The compliance angle matters too. According to ECI Research’s Google GovTech Survey, 48.0% of respondents selected “Navigating compliance documentation and audit evidence collection” as the greatest source of cognitive load for developers today. Centralized audit trails that capture initiating identity, acting agent, policy decision, and outcome address this directly. For regulated industries and public sector organizations especially, the ability to produce a coherent audit record for an AI-driven action, not just a log of API calls, is a prerequisite for operational use, not a nice-to-have.
Looking Ahead
The agentic AI market is moving fast enough that the governance deficit Datawiza is addressing will only widen in the near term. As enterprises move from single-agent experiments to multi-agent workflows coordinating across ERP, CRM, and HCM systems, the identity surface expands exponentially. The organizations that build enforcement infrastructure now will have a significant operational advantage over those that try to retrofit governance after agents are embedded in core business processes. Datawiza’s early positioning in this space, particularly its support for MCP and A2A alongside traditional API connections, gives it a credible claim on the emerging agentic middleware category.
The broader market question is whether point solutions like Agent Gateway remain independent or get absorbed into the identity platforms and cloud provider ecosystems they integrate with. Datawiza’s strongest defense is depth of protocol support and deployment flexibility, particularly for organizations with hybrid and on-premises footprints that hyperscaler-native solutions underserve. Expect the competitive dynamics here to clarify substantially over the next 12–18 months as enterprises begin operationalizing agentic workflows at scale.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
