My article on building stateless tool gateways ended with a promise deferred: the gateway is where agent traffic converges, which makes it where governance, metering, and security all attach, and the security story is large enough to deserve its own treatment. This is that treatment, and it is deliberately the adversary’s article rather than the builder’s. Where the build piece asked how do I stand up a gateway that scales, this one asks how does an attacker turn my agent estate against me, and what stops them, because the two questions have different shapes: the first is answered by architecture, the second by threat modeling, and an estate that got the first right can still lose badly to the second.
The reason the security question is genuinely new, and not merely old security with agents bolted on, is captured in a sentence the field keeps rediscovering: a firewall can block a connection but it cannot block a sentence. The agentic gateway’s defining risk is that its most dangerous inputs are not malformed packets or injection strings in the SQL sense, they are perfectly well-formed English, arriving where the system was built to follow instructions, from sources the system was built to trust. Prompt injection, tool poisoning, and exfiltration through a reasoning system are attacks on the interpretation layer, invisible to every perimeter control that inspects bytes rather than intent, and defending against them requires controls that operate where the agent’s intention meets the system’s action, which is the gateway, and which is why this article’s centerpiece is the idea of a firewall that reads sentences.
The plan is a proper threat model: the assets worth protecting and the trust boundaries around them, the adversary classes and their goals, the attack catalog with the mechanics of prompt injection, tool poisoning, and the exfiltration paths specific to a data gateway, then the layered defenses in the order they actually stop attacks, structural containment first because it is the load-bearing wall, then the semantic controls, then detection and response, then the red-team discipline that keeps all of it honest. A disclosure as always: I work at Dremio, whose gateway and governed stack sit in this threat surface, and the analysis here is architectural, mapped to the open frameworks the security community published in 2025 and 2026, and applicable to any MCP-based agent estate.
Assets, Boundaries, and Why This Gateway Is a Target
Threat modeling starts with what an attacker wants, and the agentic lakehouse gateway sits in front of an unusually rich target set, which is exactly why it earns adversary attention.
The assets, in descending order of what keeps a CISO awake. The governed data itself, the estate’s entire analytical substance reachable through the gateway’s tools, is the crown jewel, and its value to an attacker is that the gateway exists specifically to make it reachable by reasoning systems, which are more manipulable than the applications that guarded it before. The action surface is the second asset, the tools that write, remediate, file, and trigger, whose misuse turns the gateway from a data-loss risk into an integrity-and-availability risk, the agent made to do rather than merely to reveal. The credentials and scopes are the third, the principals, tokens, and grants whose compromise is lateral-movement fuel, and the governed architecture’s own machinery, the vended credentials, the compiled policies, becomes an attacker’s map if the gateway leaks it. And the telemetry is the fourth, the evidence estate my compliance-telemetry article builds, valuable to a sophisticated attacker precisely for what it records, both to learn the estate and to corrupt the record of an intrusion.
The trust boundaries define where defenses must live, and the agentic estate has one boundary that classical architectures lacked. The human-to-agent boundary is old and understood, authenticate the user, scope their session. The agent-to-gateway boundary is the build piece’s territory, per-request authentication, per-tool authorization. The gateway-to-data boundary is the governed stack’s, compiled policy and vended credentials. And the boundary that changes everything is the data-to-agent boundary, the point where retrieved content, tool results, and documents re-enter the agent’s reasoning, because that boundary carries data the system treats as information and an attacker treats as instructions, and it is the boundary that no firewall, no network control, and no classical access model was ever designed to inspect. The entire novel threat surface lives at that fourth boundary, and the article’s defenses are largely the story of learning to guard it.
The why-a-target question answers itself once the assets and boundaries are drawn: the gateway concentrates reach the way a bank concentrates money, the agents behind it follow instructions by design, and the content the agents read arrives from sources, tickets, documents, database fields, that an attacker can often write to without touching the estate’s infrastructure at all. That last property is the one that reclassifies the threat: the attacker does not need to breach the gateway, they need to get a sentence into something the gateway’s agents will read, which is a dramatically lower bar than the perimeter it bypasses.
The Adversaries
Threat models name their adversaries, because defenses that stop one class wave another through, and the agentic gateway faces four worth distinguishing.
The external content attacker never touches the estate’s infrastructure and does not need to. Their tool is indirect prompt injection: crafted content placed where an agent will read it, a support ticket, a product review, a document in a shared drive, a field in a record the agent summarizes, a public issue on a repository the agent processes, carrying instructions the agent ingests as part of its task. This adversary is the reason the data-to-agent boundary matters, their bar is the lowest of any class, and their demonstrated reach in 2026’s research is broad, production agents hijacked through content as ordinary as a pull-request title.
The malicious-server attacker exploits the estate’s own extensibility. As agent estates connect ever more tool servers, often from community registries with less scrutiny than a browser extension gets, the supply chain becomes an attack surface, and the specific weapon is tool poisoning, malicious instructions embedded in a tool’s description or its responses, fields the client renders to the model but not always to the human, so a tool that looks benign in the catalog carries a payload in the metadata the agent reasons over. This class turned from proof-of-concept to catalogued threat across 2025 and 2026, with the uncomfortable finding that more capable models, being better instruction-followers, often comply with poisoned metadata more readily, not less.
The malicious insider is the classical threat with a new amplifier. An employee with legitimate write access to a source the agents read, the CRM notes, the internal wiki, the ticket queue, can influence agent behavior estate-wide by planting content, which turns a modest access grant into a broad manipulation capability and makes the insider-plus-injection combination one the model this article builds takes seriously rather than treating injection as purely external.
And the compromised principal is the assumed-breach case: an attacker who has obtained an agent’s credentials or hijacked its session, whose reach is by definition whatever that principal was granted, and against whom the only real defense is the one the whole governed architecture was built to provide, that the grant was narrow, the actions were bounded, and the blast radius was designed to be survivable. This adversary is why containment precedes cleverness in the defense ordering ahead: the estate that assumes its agents will eventually be turned is the estate that survives the turning.
The Attack Catalog
With adversaries named, the mechanics, because defenses only make sense against the attacks they stop.
Indirect prompt injection is the root technique and the one to understand deepest. The agent’s context window makes no reliable distinction between the instructions it was given and the content it retrieved: both are tokens, and a sufficiently well-crafted piece of retrieved content that reads as an instruction gets a chance to be followed as one. The attack requires no infrastructure compromise, only that malicious content reach a resource the agent processes, and its payloads range from the crude, ignore your instructions and do X, to the subtle, content that reframes the agent’s task, poisons its understanding of the data, or plants a delayed action several reasoning steps downstream. The research consensus of 2026 is sobering and worth internalizing: no prompt-level defense, no instruction to ignore injected instructions, no detection heuristic, closes the channel reliably, because the offense generates new phrasings faster than any pattern-matcher ships, and the more capable the model, the more susceptible it can be, since capability is instruction-following and injection is an instruction. This is the finding that forces the architecture: if the model cannot be trusted to resist manipulation, the system around it must ensure that a manipulated model cannot do damage, which is a containment problem, not a detection problem.
Tool poisoning is indirect injection aimed at the tool layer, and it exploits a specific trust gap: tool descriptions are reviewed once, at connect time, and tool responses flow into the agent’s context at runtime with no equivalent check. A malicious or compromised server embeds instructions in the description the agent reads to decide what to call, or in the responses it returns, and the agent, reasoning over poisoned metadata, gets steered toward misusing its legitimate tools, reading the file it should not, posting the data it should not, calling the restricted capability the injection named. Benchmark work across 2026 found alarming success rates against unprotected agents, and the persistence property distinguishes it from ordinary injection: a poisoned tool description attacks every agent that connects, continuously, without the attacker re-delivering anything.
Exfiltration through the reasoning system is the data gateway’s signature risk, and it composes the above into loss. The pattern: an injection or poisoning steers the agent to retrieve sensitive data through its legitimate, authorized reads, then to exfiltrate it through an available channel, a tool that posts outward, a crafted response the attacker retrieves, a request whose parameters encode the payload. The insidious property is that every step can be individually authorized, the read the agent was allowed to make, the outbound tool it was allowed to call, so an access-control model that checks each action in isolation sees nothing wrong, and only a control that evaluates the shape of the whole, sensitive read followed by outbound flow, catches it. This is the attack that most punishes the isolation-blind access model and most rewards the semantic controls ahead.
The action-surface attacks round out the catalog: injections and poisonings that steer write-capable agents toward destructive or fraudulent actions, the file request that should not be filed, the record that should not be changed, the transaction that should not be triggered, which turn the impact profile from confidentiality to integrity and availability, and which is why the write surface deserves the disproportionate caution the defenses assign it. The through-line of the whole catalog is the one the assets section named: these are attacks on interpretation, well-formed inputs at trusted boundaries, and the defenses that work are the ones that stop making the model the last line.
Defense Layer One: Structural Containment
The load-bearing defense is architectural and unglamorous, and it comes first because it is the only layer that holds when every cleverer layer fails: bound what a compromised agent can do so tightly that the compromise, when it happens, is survivable. This is the governed architecture from across this series, viewed through the adversary’s eyes, and each familiar control reveals its security purpose.
Least-privilege principals are the foundation. Every agent holds its own principal, scoped to the narrowest tool catalog and data grants its function requires, never a shared or broad account, so that a fully hijacked agent’s reach is precisely its function’s reach and nothing more. The build piece prescribed this for cleanliness, and the threat model reveals its real job: the blast radius of any compromise is a design parameter, set at grant time, and the estate that scopes tightly has already won the argument the incident will otherwise have for it.
Compile-time policy enforcement is the containment that injection cannot touch. Because the semantic layer folds row and column policies into every query at compilation, before any SQL exists, a manipulated agent requesting data outside its principal’s scope does not get filtered results, it gets a query that structurally cannot reach the forbidden rows, and no injected instruction can talk the compiler out of a policy it enforces by construction. My text-to-SQL and semantic layer articles argued this for correctness and governance, and here is its security dividend: the policy is enforced where the model’s manipulation cannot reach, which is the single most important property the governed stack contributes to the threat model.
Bounded tools are containment at the action layer. Agents act only through the fixed, typed, governed tools the gateway publishes, never through raw table access or arbitrary code, so the ceiling on a manipulated agent’s action is the union of its granted tools’ defined behaviors, each of which was designed, reviewed, and scoped. The write tools carry the extra discipline the action-surface threats demand: separated from reads, granted to few principals, made idempotent, and, for the consequential ones, gated behind confirmation, so that the destructive action an injection reaches for is either absent from the agent’s world or fenced behind a step the injection cannot satisfy alone.
Credential vending removes the standing keys an attacker most wants. No agent holds durable storage credentials, access arrives short-lived and scoped per request through the catalog’s vending, so a compromised principal yields no reusable keys and its access evaporates with its scope, which converts credential theft from a lasting foothold into a bounded, expiring window.
The layer’s summary is the threat model’s central bet: assume the model will be manipulated, and make manipulation insufficient. Every control here works whether or not the agent was fooled, because none of them asks the agent to not be fooled, and that property, security that does not depend on the model’s judgment, is what separates an estate that survives its first real injection from one that learns about containment during the incident review.
The Write Surface Deserves Its Own Paranoia
The catalog’s action attacks earn a section of their own, because the shift from reading to acting is the shift that changes an agent breach from an embarrassment into a crisis, and the write surface is where the threat model spends its deepest caution.
The asymmetry is the reason. A manipulated read agent leaks, which is serious and bounded by what it was allowed to see, and a manipulated write agent acts, which is unbounded in a different direction, the fraudulent transaction, the destroyed data, the triggered downstream process, the record changed to enable a later fraud, and the impact profile moves from confidentiality alone to integrity and availability, the two properties that turn a data-loss headline into an operational outage. The industry’s own framing captured the shift precisely: an injection against a summarizer biases an output, and an injection against an acting agent triggers an action, which is why the defensive posture around write tools is deliberately more restrictive than efficiency alone prefers.
The disciplines the write surface earns, layered. Scarcity first: write tools are rare, granted to few principals, and absent by default, so the majority of the agent estate simply cannot act destructively because it holds no tool that acts, which makes the action-surface attack a non-event for most of the estate by construction. Separation second: write capabilities are their own principals and their own grants, never bundled with reads for convenience, so an agent’s read compromise does not hand the attacker its write capability, and the two blast radii stay distinct. Idempotency and reversibility third: the write tools that exist prefer operations that repeat safely and reverse cleanly, the branch-staged, gated, revertible writes my Write-Audit-Publish article builds, so that even a write an attacker triggers lands in a place designed to be inspected and undone rather than directly on the state consumers read. And confirmation fourth, for the consequential few: the most dangerous actions gate behind a human or a second-factor step the injection cannot satisfy alone, the multi-round-trip confirmation the stateless protocol supports, which converts the destructive action from a thing an agent can be talked into to a thing that requires a party the attacker does not control.
The write surface’s design test is a sentence worth keeping: for every tool that changes the world, ask what an attacker who fully controls the agent does with it, and if the answer is unacceptable, the tool is too broad, too available, or too direct, and the fix is scarcity, separation, staging, or confirmation, applied until the answer becomes survivable. The estates that run this test at tool-design time build a write surface that is boring under attack, which is the highest compliment the threat model pays.
Defense Layer Two: The Firewall That Reads Sentences
Structural containment bounds the damage, and it does not prevent the manipulation, so the second layer adds controls that operate where the classical stack is blind: at the semantic level, between the agent’s intent and the system’s action, evaluating not whether a request is well-formed but whether it is consistent with what the agent is actually authorized and expected to do. This is the semantic firewall, and its defining property is that it inspects meaning, which is the only layer that can, because the attacks are made of meaning.
Tool schema validation at the gateway closes the tool-poisoning channel at its source. Rather than trusting tool descriptions reviewed once at connect time, the gateway treats tool discovery as untrusted ingress, the way a load balancer treats inbound HTTP: every tool schema is inspected before it reaches a model, checked against the estate’s registered, approved definitions, screened for the instruction-shaped content that poisoning hides in description fields, and forwarded only if clean, with changes to a server’s advertised tools flagged for review rather than silently propagated. This is the single control point the poisoning threat most demands, because it converts the twelve-clients-patched-individually problem into one gateway that updates once when the threat landscape shifts, and it sits exactly where the header-routed, catalog-publishing gateway from the build piece already inspects traffic.
Intent-consistency checking is the firewall’s core and the exfiltration threat’s antidote. The gateway evaluates each tool call, and each sequence of calls within a workflow, against the shape the agent’s task and authorization imply, and flags or blocks the requests that do not fit: the sensitive read followed by an outbound-posting call, the access pattern that matches no legitimate task, the parameter payload that carries more than a parameter should. The control’s power is that it sees composition, the whole shape that individually-authorized steps hide, which is precisely the blindness the exfiltration attack exploits, and its home is the gateway because the gateway is the one place every step of every workflow passes, tagged with its principal and its workflow identifier, visible as a sequence rather than as isolated calls.
Content-boundary controls harden the data-to-agent boundary directly. Retrieved content and tool responses that will re-enter the agent’s reasoning get treated as untrusted: structurally delimited so the model can distinguish task instructions from retrieved data where the framework supports it, screened for the high-signal injection patterns worth catching even knowing pattern-matching is incomplete, and, for the highest-sensitivity flows, run through the dual-path pattern the research community converged on, where a privileged planning agent that never sees raw retrieved content directs a quarantined agent that processes the content but holds no dangerous capabilities, so that the component exposed to injection cannot act on it and the component that can act never sees the injection.
The honest framing of this layer, which the security-serious estates insist on: the semantic firewall raises the cost and catches a real fraction of attacks, and it is not a solved problem, injection defense at the content level remains an arms race, which is exactly why it is layer two and not layer one. Its job is to reduce the load on containment and to catch what containment alone leaves merely bounded, not to be the thing the estate trusts, and an estate that inverts the order, that leans on the firewall and skimps on containment, has built its security on the arms race’s losing side.
Defense Layer Three: Detection, Response, and the Evidence Trail
The third layer assumes the first two will sometimes fail and builds to see it, contain it, and prove it, which is where the observability and telemetry planes from across this series become security infrastructure.
Detection reads the traces the gateway already emits. Every tool call, principal, workflow, and policy decision lands in telemetry, and the security overlay watches for the shapes the attack catalog defines: the exfiltration sequence, the access pattern outside a principal’s learned baseline, the spike in declines that means an agent is probing its bounds, the tool-schema change that arrived without a review, the workflow whose reasoning trace shows the hallmarks of hijack. This is the goal-directed anomaly detection my quality-agents article built, pointed at security rather than data quality, and it works for the same reason: the governed estate’s traffic is legible, principals are identified, and workflows are threaded, so the anomalous shape has a baseline to violate.
Response leans on the containment already in place. The estate that scoped its principals can revoke one in a single grant change, killing a compromised agent’s access instantly through the governance repository, and the vended-credential model means the revocation actually takes effect at the next request rather than waiting for a standing key to expire. The bounded-tool model means containment can be surgical, suspend the write tools while leaving reads, throttle a probing principal to a crawl, quarantine a suspect workflow, each a policy change through the same reviewed, reverted machinery that governs everything, which turns incident response from a scramble across systems into an operation on the estate’s own controls.
And the evidence trail is the compliance telemetry doing security duty. The policy-aware ledger my EU AI Act article builds records what every agent did, with what data, under what policies, which is exactly the record a security investigation reconstructs from: the compromised principal’s full activity resolves by identifier, the exfiltration’s path traces through the input references and the outbound calls, the injection’s entry point often shows in the content the agent read, and the whole reconstruction runs as SQL against tables designed to be immutable and addressable. The estate that built evidence for the regulator finds it has built forensics for the incident, one more instance of the series’ arithmetic, and the security value of that record is high enough to justify the telemetry investment on its own.
The three layers compose into the posture the threat model targets: containment makes compromise survivable, the semantic firewall makes it harder and catches a real share, and detection-and-response makes it visible, contained, and provable when it happens anyway. No layer is sufficient, the composition is the security, and the ordering, containment first, is the discipline that keeps an estate from betting its data on the arms race it cannot win.
Mapping to the Frameworks
The security community formalized this territory across 2025 and 2026, and mapping the threat model to the published frameworks helps teams speak the common language and check their coverage.
The OWASP work is the primary reference, with the agentic top-ten released in late 2025 sitting alongside the established language-model top-ten, and the categories this article’s attacks land in are the ones defenders now track by name: tool misuse, the poisoning and injection-driven steering of legitimate tools, and agentic supply chain, the malicious-server and dependency-poisoning class, with the exfiltration and excessive-agency concerns threading through both. The value of the mapping is coverage-checking: an estate can walk its defenses against the framework’s categories and find the gaps it rationalized, which is the exercise the red-team section makes routine.
The threat-modeling methodologies transfer with one addition. The classical decomposition, assets, boundaries, adversaries, attacks, mitigations, that structured this whole article is the standard practice, and the agentic addition is the data-to-agent boundary and the interpretation-layer attack class, which the classical methods did not contemplate because classical systems did not follow instructions found in their data. Teams already running threat models add the boundary and the class rather than starting over, which is the honest good news, most of security engineering’s accumulated discipline applies, and the new surface is an addition to the model, not a replacement of it.
And the research benchmarks are the reality check. The tool-poisoning and injection benchmarks published across 2026 exist to measure how agents actually behave under attack, and their findings, high success rates against unprotected agents, capability correlating with susceptibility, the persistence of tool poisoning, are the empirical backbone of this article’s central bet on containment over model judgment. An estate serious about the threat runs its own agents against the public benchmarks and its own red-team scenarios, because the abstract argument that models cannot be trusted to resist injection becomes an actionable number when it is your agents’ success rate under your attacks.
The Trust Gradient: Not All Content Is Equal
A refinement the mature estates add, worth its own section because it sharpens every layer above: content is not uniformly dangerous, and grading it by trust lets the defenses concentrate where the risk concentrates rather than taxing everything equally.
The gradient runs from the estate’s own governed data, the tables under the catalog whose provenance and quality the whole series worked to guarantee, which is the most trustworthy content an agent reads and the least likely to carry an injection, through to the external free-text an attacker can write to at will, the tickets, the reviews, the public issues, the shared documents, which is the least trustworthy and the injection’s natural home. The design consequence is proportionate defense: the agent reasoning purely over governed metrics through the semantic layer operates in a low-injection-risk zone, its content vetted by the estate’s own pipelines and gates, while the agent that summarizes inbound tickets operates in the hot zone and earns the heavier controls, the content-boundary screening, the dual-path quarantine, the intent-consistency scrutiny turned up.
The gradient also guides the estate’s highest-value hardening: the flows that combine untrusted content intake with sensitive data access or write capability are the ones that most deserve the dual-path architecture, the quarantined reader that processes the ticket holding no dangerous tools, the privileged planner that acts holding no exposure to the raw ticket, because the combination is where the exfiltration and action attacks complete, and separating the exposure from the capability is the structural answer to a structural risk. The estates that map their agents onto this gradient, which read the hot content, which hold the dangerous capability, which do both, find their security investment sorting itself, the both agents at the top of the priority list and the governed-metrics readers comfortably down it.
The gradient’s honest caveat keeps it from becoming complacency: governed data is lower-risk, not no-risk, because the insider and the compromised-upstream cases can plant instructions even in trusted sources, which is why the gradient tunes the defenses’ intensity rather than switching any of them off, and why the containment layer, indifferent to content trust because it never relies on the content being safe, remains the floor under every zone of the gradient alike.
Red-Teaming the Gateway: Making the Threat Model Live
A threat model on paper decays the moment the estate changes, and the discipline that keeps it alive is adversarial testing run as a standing practice, not a launch-day audit, because the offense evolves weekly and the defense has to be checked at the same cadence.
The adversarial suite is the practice’s spine, and it belongs in CI beside the evaluation and quality suites the rest of this series builds. Its cases are the attack catalog made executable: injection payloads planted in the content sources the agents read, poisoned tool schemas offered at the gateway’s ingress, exfiltration sequences attempted through legitimate tool chains, cross-principal access probed through crafted requests, write-surface abuse attempted through steered actions, each with its expected result being structural refusal, and each run on every release so that a regression in containment fails the build the way a broken test does. The suite grows with the threat landscape, new public techniques added as they publish, past incidents added as their regression guards, which turns the security team’s reading into the estate’s coverage.
The exercise cadence tests what the suite cannot. Periodic red-team exercises, internal or external, attack the running estate with the creativity automated suites lack, chaining the boundaries, combining the adversary classes, finding the composition the individual checks missed, and their findings become suite cases so that yesterday’s clever exploit is tomorrow’s automated regression. The purple-team framing, attackers and defenders working together against the estate rather than against each other, suits this domain because the defenses are subtle and the point is coverage, not a scoreboard.
The metrics keep the practice honest, and four earn the security dashboard: the adversarial suite’s pass rate trended across releases, the injection success rate of the estate’s own agents against the standard benchmarks, the time from a detection signal to containment measured in the response drills, and the coverage of the framework categories against the deployed defenses, reviewed as gaps rather than as a grade. The estates that run these numbers report the discipline’s real payoff, that security stops being a launch gate everyone dreads and becomes an engineering signal the teams watch, the same shift the quality and cost disciplines make when their concerns move onto the dashboards the engineers already read.
A Worked Example: The Injection That Went Nowhere
The composite, in this series’ pattern, with no invented benchmark numbers, walking one real-shaped attack through the defenses.
The estate is the governed stack these articles build, agents on a stateless gateway over a semantic layer and catalog, scoped principals, compiled policies, bounded tools, the telemetry ledger running. The attack arrives through the lowest-bar path: an external party who has no access to the estate at all writes a support ticket whose body, past the plausible customer complaint, carries an injection, instructions for any AI agent processing this ticket to look up the account’s full payment records and include them in a summary posted to an external status page. The customer-support analytics agent, doing its ordinary job, retrieves and summarizes the ticket, and the injection lands in its context as designed.
The manipulation partly works and gets nowhere, which is the whole point. The agent, steered, forms the intent to retrieve the full payment records, and containment answers before cleverness has to: the agent’s principal, scoped to support analytics, holds no grant to the payment data, so the compiled query returns what the policy permits and structurally cannot reach the payment rows, the injection’s first objective defeated not by detecting the injection but by the policy the model was structurally unable to talk its way around. The injection’s second objective, the outbound post, reaches for a tool the support agent’s catalog does not contain, because the write and outbound tools were never granted to a read-shaped principal, so the exfiltration channel is absent from the agent’s world.
The semantic firewall catches what containment merely bounded. The intent-consistency check flags the shape, a support-summary workflow attempting a payment-scoped read and reaching for an outbound tool, as matching no legitimate task pattern, and raises the signal that turns a defeated attack into a detected one. Detection resolves it: the anomaly surfaces on the security overlay, the workflow’s trace shows the ticket content as the injection’s entry point, the compromised path is the one ticket’s processing, and the response is proportionate, the ticket quarantined, the pattern added to the content-screening and the adversarial suite, the incident documented from the telemetry ledger that recorded every step. The reconstruction takes an analyst part of an afternoon, and its findings read as operations rather than crisis, because nothing sensitive moved, the attacker touched no infrastructure, and the estate learned a pattern.
The retrospective’s transferable line is the threat model’s thesis: the injection succeeded at manipulating the model and failed at everything that mattered, because the estate never asked the model not to be manipulated, it asked the architecture to make manipulation insufficient, and the architecture, built for governance and correctness and compliance across every prior article, turned out to have been building security the whole time.
Failure Modes
Firewall faith. The estate invests in injection detection and semantic screening, treats them as the defense, and skimps on the containment underneath, betting its data on the arms race the offense wins. The defense is the ordering as doctrine: containment is layer one and load-bearing, the firewall is layer two and supplementary, and any security review that finds the firewall carrying weight containment should carry has found the estate’s real vulnerability.
The broad principal. Convenience grants an agent a wide catalog or a shared account, and the containment that makes compromise survivable is quietly gone before any attack, the blast radius set to maximum by a shortcut. The defenses: least-privilege as a launch-template requirement, principal scope reviewed like the security control it is, and the periodic audit that enumerates each principal’s actual reach against its function’s need.
The ungoverned side door. A team stands up an agent or a tool server outside the gateway, and the estate’s whole defense stack, containment, firewall, detection, applies to everything except the path the attacker will find. The defenses: network policy that routes agent traffic through the gateway, the coverage map that enumerates every agent and server against the governed path, and the cultural rule that the paved road is the only road for anything touching governed data.
Trusting the tool catalog. Servers are added from registries with browser-extension scrutiny, tool schemas are trusted at connect time and never re-checked, and poisoning walks in through the supply chain the estate never inspected. The defenses: the gateway’s schema validation as mandatory ingress, server addition as a reviewed supply-chain decision, and schema-change alerting so a server that mutates its tools gets caught rather than trusted.
Detection without response. The signals fire into a channel nobody watches, or the estate can see a compromise it cannot quickly contain because the principals were never scoped for surgical revocation. The defenses: the response drills that measure signal-to-containment time, the containment surgery rehearsed before it is needed, and the security overlay wired to the same on-call rigor as any tier-one system.
The frozen threat model. The model is built once, at launch, and the estate defends against 2026’s attacks in 2027 while the offense moved on. The defense is the red-team discipline as a standing practice, the adversarial suite in CI growing with the landscape, and the threat model itself reviewed on a cadence, because the one certainty in this domain is that the attack catalog is not finished.
Conclusion
The agentic lakehouse gateway is a target because it concentrates reach, its agents follow instructions by design, and the content those agents read arrives from sources an attacker can write to without breaching anything, which puts the estate’s most dangerous inputs in the form of well-formed sentences at a boundary no classical control was built to inspect. The threat model that answers it is honest about the hardest finding, that the model cannot be trusted to resist manipulation, and builds accordingly: structural containment first, so that a manipulated agent’s reach is bounded, its policies uncircumventable, its tools limited, and its credentials expiring, because that layer holds when every other fails, a semantic firewall second, reading the meaning the perimeter cannot, catching tool poisoning at ingress and exfiltration in composition, and detection with response third, turning the estate’s own telemetry into the sight and the evidence that make an attack visible, contained, and provable.
The deeper conclusion is the series’ last refrain, and it is the most reassuring one: the estate that built the governed, layered architecture across every prior article has already built most of its security, because least-privilege principals, compile-time policy, bounded tools, vended credentials, legible telemetry, and reviewed change are not separate from the governance, the correctness, and the compliance that motivated them, they are the same properties answering a fourth question. Security is not a layer bolted onto the agentic lakehouse. It is what the whole architecture was, seen from the direction of the adversary, and the estate that assumes its agents will be turned and makes the turning survivable is the one that gets to keep treating its incidents as operations. Build the containment first. The cleverness is welcome, and it is not what saves you.
Keep Going
If this piece was useful, the architecture it defends runs through this series and my books: the gateway build it secures, the semantic and catalog layers that contain, the telemetry that proves, and the platform foundations in Architecting an Apache Iceberg Lakehouse from Manning alongside Apache Polaris: The Definitive Guide and Apache Iceberg: The Definitive Guide from O’Reilly. You can find every book I have written, across lakehouse architecture, Apache Iceberg, Apache Polaris, and AI, at books.alexmerced.com.