Don't buy an AI gateway before you know what your agents touch

TL;DR • Citrix's AI governance post gets the diagnosis right — agent traffic is a second, ungoverned layer, MCP servers are writable, and sprawl is compounding — then spends the rest of the article selling NetScaler as the one platform that closes both layers. • The unattributed anecdote about agents deleting critical data "in seconds" is a rigor failure in a post that lectures enterprises on rigor, and the gateway-first answer skips the question that actually matters: what are your agents allowed to touch, and who decided that? • Before spending on gateways, answer who controls access: which servers agents can reach, who approved it, what is recorded, and how a bad action gets undone. For most companies that answer is the governance; the tool is a nicer dashboard on top of it.

What happened

Citrix argues that enterprise AI has stopped being a chat window: "AI is now taking action — agents are calling into backend systems, querying databases, executing workflows, and moving money and data on behalf of the business." That shift, the post says, will be "the story of 2027," and it closes on a bigger claim: "agentic AI is going to be the defining infrastructure conversation of the next 24 months."

The post distinguishes two distinct layers of traffic that need governing — the LLM layer, where prompts and responses flow to model providers, and the agentic layer, where agents call MCP servers to act inside your environment. The MCP detail is worth being precise about. "An MCP server is essentially a standardized, self-describing API," and "many are writable, meaning an agent can create, change, and delete data, not just retrieve it." The article is also blunt that "MCP is on the same trajectory, only faster" than the shadow SaaS and shadow API sprawl that came before: every team standing up an agent also stands up MCP servers, each with its own endpoint, its own authentication scheme, its own rate limits or none, and its own blind spot in observability.

Then comes a sentence worth pausing on: "The industry has already seen cases where an agent given access to production systems without adequate controls deleted critical data in seconds." No name. No date. No case. The post then warns against the point-product chain — "a chain of five vendor logos" — and presents its own answer: MCP Gateway capabilities added to the NetScaler AI Gateway, with "MCP Gateway and the AI Gateway enhancements are included in existing NetScaler entitlement at no additional cost."

Netics' take

The diagnosis is right, and the pitch rides on its back. That is exactly how these posts work, and it does not make the diagnosis wrong. It makes it incomplete.

Start with the MCP detail, because it is the whole problem. A standardized, self-describing API that advertises writable capabilities to any agent is a governance event waiting to happen. An agent can create, change and delete data, not just retrieve it — that is what makes the protocol powerful, and it is exactly what makes it dangerous when nothing stands between the agent and your systems. The sprawl framing is accurate: an ungoverned traffic layer with no consistent identity and no unified audit trail.

Then there is the anecdote. For a post that is, in effect, lecturing enterprises on rigor, an unattributed scare story is a strange way to lead. Either the deleted-data case is real and should be documented — a name, a date, a sector — or it is a vendor anecdote doing rhetorical work. We would rather ask than repeat it.

The point-product trap has a vendor at the end of it. The warning about a chain of five vendor logos is real; the solution is conveniently the product being sold, already in your entitlement, already in your contract — "no separate SKU, no add-on license, no metered fee." The post urges enterprises to treat governance "as an architectural decision, not a shopping list of point products," then sells the single platform that collapses the list. It is the same move we flagged when Google canceled its AI Studio app to make the platform the product — the vendor's roadmap becomes your risk either way. It is possible to hold both: the diagnosis is right, and the pitch borrows its urgency.

Here is what neither half of the article says: before you buy any gateway, you need an inventory. Take a concrete case. A mid-size company has three agents in production — one reads the support inbox and drafts replies, one updates the CRM, one triggers a deployment webhook. None was provisioned through a central team, and nobody can say with certainty which MCP servers they can reach today. A gateway in front of that is a point product in a trench coat. It gives you logs and policy hooks, but the hard question is not where the choke point sits; it is what the agent is allowed to touch and who decided that. This is the same argument we made before giving AI agents tools in the first place: the first problem is not where agents run, it is what they are allowed to touch. A gateway does not answer that; an inventory does.

At Netics we run n8n workflows, a RAG pipeline, and an autonomous coding agent on our own infrastructure. That agent works from written rules — what it can touch, what the conventions are, what the roadmap is — because an agent without written context is confident and wrong. Nothing about that required a purchase order, and it is the part governance products cannot sell you. I spent years running Citrix NetScaler and ADC VPX in production, secure external access for XenApp environments at enterprise scale; reading a positioning post against that deployment history is how I tell it from a real one.

What this means for SMBs

For companies in regulated European markets, the gap is even less about traffic and more about evidence. DORA and NIS2 want auditability, and a proxy that logs traffic is necessary but not sufficient. You still need to answer who decided an agent could touch customer records, which data crossed a border, and what happens when the agent is wrong. Those are policy and ownership questions, not product questions. The map comes first:

• Inventory what your agents can reach, including MCP servers nobody remembers standing up
• Record who approves access for each agent and each server
• Decide what gets logged and who reads the logs
• Define the rollback path for a bad agent action before it happens

Bottom line

The Citrix diagnosis is right: the agentic layer is the next governance problem, and MCP sprawl is the name of it. Just do not let the pitch borrow the urgency. The post's own closer is the tell — for most customers, closing the gap "doesn't require a new vendor — it requires turning on what's already there." That is a licensing sentence wearing a governance argument. Start with the map — inventory what your agents can reach, who approves it, what gets logged, how you roll back. Then buy the gateway, if you still need it. Most companies will find the map was the governance, and the gateway was a nice dashboard on top of work they should have done anyway. Book a free 30-minute audit and we will help you build the inventory before you buy the gateway.

Source: The AI governance gap executives can't ignore — and why it's about to get worse — citrix.com/blogs, 2026-07-16. Commentary by Netics.

Explore Netics for practical infrastructure and AI operations guidance.