Snowflake Inc. today introduced Cortex AI Gateway, a centralized control layer that lets enterprises connect, govern and monitor artificial intelligence agents as they reach into models, tools, Model Context Protocol servers and internal systems.

The company cast the gateway as the connective tissue for the “agentic enterprise,” the point at which autonomous software agents start acting across corporate data and applications rather than simply retrieving information. Traditional security architectures were not built for that level of cross-system activity, Snowflake argues, leaving organizations without a consistent way to see what their agents are doing or what those agents cost.

Cortex AI Gateway is designed to govern agents built inside Snowflake, including its own CoWork and CoCo agents, alongside third-party agents developed on outside platforms such as Claude Code and Cursor. It supports more than 100 MCP servers and centralizes the access policies, authentication and permissions that decide which models, data, applications and tools each agent can touch.

The product builds directly on Snowflake’s acquisition of Natoma Labs Inc., the MCP governance startup it agreed to buy in May. Natoma’s technology gives the gateway an enterprise-grade MCP platform for brokering secure connections between agents and the systems they act on.

Access control is only part of it. The gateway keeps an end-to-end record of agent activity, giving teams a single log of which agent did what, which tools and systems it reached and the order of steps it followed. It also tracks token consumption across models, teams and workloads, attributes those costs to the agents driving them and lets finance and information technology teams enforce spending limits, a hedge against the runaway bills that can come with agents running at scale.

“Enterprise AI is moving from data interoperability to agent interoperability, and security has to be at the center of that shift,” said Mayank Upadhyay, chief security and trust officer at Snowflake. “Agent interoperability only works when enterprises can trust how agents from different platforms access data, invoke tools and take action on behalf of users. The future of the agentic enterprise will not be built in closed agent ecosystems, and Snowflake is the trusted control plane that enables secure enterprise work.”

Snowflake paired the gateway with a first wave of secure third-party agent access integrations with identity and security vendors Aembit Inc., Linx Security Inc., SailPoint Inc., Saviynt Inc. and AgileBits Inc., the maker of 1Password. The integrations target a common blind spot in which an agent operates under a user’s broad credentials, making it hard to tell which agent reached which data and under whose authority.

Each partner tackles a different piece. Nancy Wang, chief technology officer at 1Password, said the integration gives third-party agents short-lived, task-scoped access tied to a clear record of the person behind each agent, letting companies move agents into production without leaving them standing access to sensitive data.

Aembit takes the credential angle: C0-founder and Chief ExecutiveDavid Goldschlag said its policy-based access does away with long-lived credentials. Saviynt works at runtime, weighing an agent’s intent and permissions before letting it act, while SailPoint frames its role around giving security teams visibility and accountability over third-party agent access.

Media intelligence firm Meltwater N.V. is one early adopter. Chief Technology Officer Aditya Jami said the gateway should let its agents connect to the right data and tools without loosening the controls its own customers count on.

The gateway arrives with a batch of security updates that push zero-trust principles further into AI. Generally available now are tools for gauging AI risk posture, giving agents a verified identity and shielding sensitive data. Controls that hold an agent session to the scope of a single task remain in private preview.

Cortex AI Gateway is due in public preview soon. The third-party agent access integrations will follow in private preview.

Image: SiliconANGLE/Ideogram