01 / What each boundary answers
Compare the decision, not the label.
Can authenticate an MCP client, validate transport tokens, observe tool calls and reject requests traversing the gateway.
Can inspect final resource state and bind the decision to the exact downstream operation before committing it.
02 / Same operating case
Which request must be stopped?
An agent calls update_customer through an MCP server with a valid token, but targets another tenant.
Evaluation exercise
Repeat a denied cross-tenant update through a direct server-to-API route that skips the MCP gateway. The target API must still refuse the wrong account.
03 / Architecture fit
How the controls can compose
Gateway and executor can share policy context, while each protects the boundary it actually sees.
A gateway cannot govern a bypass route it does not intercept or infer state it cannot observe.
04 / Evidence
Prove the decision and the effect separately.
Correlate gateway request, token check, tool arguments, downstream decision and customer record version.
Primary sources