The Atlas take.
Zscaler AI Gateway is worth evaluating when the requirement is governing agent communications across supported MCP and A2A paths. The current product page describes per-request authorization, an agent registry and context-aware policy, which is a different control purpose from a simple model API proxy. Atlas would make trusted identity binding and bypass resistance central to the trial. A gateway can govern what traverses it; agents retaining direct access to the same destination still need independent constraints. Broader discovery, red teaming and Agentic SOC functions should not be folded into this profile automatically.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
Evaluate AI Gateway independently from Zscaler endpoint discovery, red teaming and Agentic SOC products. Verify protocol support and traffic routing.
Zscaler positions AI Gateway as an authorization point for agent-to-tool and agent-to-agent traffic. The architectural fit is an organization that can broker those communications centrally and supply agent identity and access context. Evaluate the gateway as an inline policy decision, alongside the surrounding discovery and content controls.
- Also covers
- Agent identity and access security · AI interaction and data protection
- Deployment surface
- Custom/cloud agents
- Integration point
- Gateway/proxy
- Availability
- Confirm availability
Documented scope; confirm release status, supported integrations and entitlement for the selected offering.
03 / THE CONTROL PATH
Where it sits. How it works.
Atlas architecture interpretation: supported MCP/A2A traffic enters the gateway with bound identity, contextual policy authorizes the request, and the target interaction supplies independent execution evidence.
- 01
Agent identity and supported protocol
Identify the actual caller, transport and path used to reach the selected gateway.
- 02
Registry and per-request policy
Apply the approved agent ownership/permission context and inspect the resulting decision.
- 03
Tool or peer-agent outcome
Verify permitted execution or denied access at the destination and correlate the audit trail.
Route the relevant traffic through the gateway
The product describes an inline communication control point. Obtain the onboarding and routing design for homegrown and third-party agents and identify what happens when they attempt an alternate connection.
Integrate access context and registration
The gateway uses registry and graph context, with policy in the Zscaler framework. Require a demonstration of identity registration and how permissions are updated when ownership or task scope changes.
Scope adjacent platform functions
AI Red Teaming, AI Guard for Users, and AI Endpoint Security appear as complementary platform areas. Confirm their separate deployment and license needs instead of counting all platform functions as gateway coverage.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
The documented purpose is authorization
The gateway page explicitly centers request-level agent authorization across MCP and A2A, giving the pilot a precise control question.
Ownership context is part of the design
The documented agent registry provides a useful requirement for connecting permissions with an accountable owner.
Inspect the documented capability notes
Evidence reviewed: Current AI Gateway product explanation and FAQ. Protocol claims are public, while detailed transport and deployment support need confirmation.
MCP and A2A brokering
The gateway sits on agent communication paths using MCP and A2A. It evaluates requests before they reach tools, data, or other agents; establish the supported transports for your intended connections.
Agent Registry ownership and permissions
Zscaler describes a registry assigning agents an identity, owner, and permission scope, including short-lived agents. This is intended to make authorization and accountability possible beyond a user’s initial login.
Context-aware per-action authorization
The documented decision uses agent identity, requested operation, and access context. AI Access Graph supplies reachability context so policies can restrict activity to the agent’s intended scope.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
Protocol detail needs confirmation
The public description names MCP and A2A without establishing the full versioned transport/deployment matrix in the reviewed sources.
The wider platform is separate scope
AI discovery and red-teaming context in the broader security portfolio should be verified as distinct integrations and entitlements.
Additional coverage boundaries
- The public page names MCP and A2A but does not establish every transport, authentication scheme, streaming behavior, or tool-level decision format. Request a connection support matrix.
- An inline decision needs trustworthy identity and operation context. Verify how a delegated agent, an ephemeral agent, and a chained agent retain the correct initiating user and task scope.
- Ask for enforcement latency, high-availability design, outage behavior, audit exports, data residency, and the license relationship among gateway, registry, graph, and content inspection.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Inventory every destination route
Record agent credentials, protocol transports and direct alternatives to the intended gateway path.
- 02
Prove identity binding
Use two test agents with different owners and permissions; verify that client-editable fields cannot select another identity.
- 03
Operate policy safely
Define review, exception expiry, failure behavior and rollback for a mistakenly denied business workflow.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Request an AI Gateway-specific quote with supported protocols, deployment, registry and authorization scope. Itemize other Zscaler AI Security functions and routing infrastructure separately.
- Gateway deployment and covered agent/interaction scope
- Required identity, discovery and routing integrations
- Separate testing modules and policy operations
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Amazon Bedrock AgentCore Policy
Compare explicit gateway tool authorization where the workload can use AgentCore; business-rule language and target scope differ.
WitnessAIWitnessAI Agentic Security
Compare supported MCP observation/enforcement paths and identity attribution, verifying that the required authorization is actually enforced.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Permit one test tool and deny another
Acceptance evidence: Preserve bound identity, policy and target-side invocation evidence.
- TEST 02
Attempt the same destination outside the gateway
Acceptance evidence: Document the independent control that removes or limits the bypass.
- TEST 03
Change an agent permission under review
Acceptance evidence: Verify effective timing, audit and reversal for subsequent calls.
START WITH ONE EXERCISE
A cloud agent tries a permitted lookup followed by a call to an unapproved MCP server.
Evidence to look for: Compare gateway records with server receipts and verify that the denied route made no call.
Questions to bring to the vendor
- Which MCP and A2A transports are supported?
- How is agent identity bound to each request?
- Can agents reach the same destination outside the gateway?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- Atlas has not independently tested authorization correctness or gateway performance.
- Obtain current transport support, failure semantics and deployment/data-handling documentation.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- Zscaler: AI Gateway control model and scope ↗Product information
- Zscaler AI Security portfolio boundaries ↗Product information
KEEP BUILDING YOUR JUDGMENT