A common mistake in deploying AI agents is prioritizing gateway security over foundational identity and attribution layers. Gateways are often implemented first, but they lack the necessary context about agent actions and delegated authority. This leads to vulnerabilities, as demonstrated by a critical flaw in an AI gateway that allowed command execution. True agent security requires a layered approach, with identity and attribution preceding gateway enforcement.The failure pattern arises from implementing controls before the upstream dependencies, like identity and context, are established. A gateway, for instance, may authenticate a user token but fail to recognize an agent's specific limited function or untrusted origin. Consequently, a valid credential and permissible API call could result in inappropriate actions. Simply limiting an agent's privileges to a human principal's level does not create distinct attribution.A dependency-gated deployment model suggests a six-gate process, starting with agent inventory and accountable ownership. This is followed by distinct agent identity, task-scoped credentials, attributable telemetry, runtime action enforcement, and finally, behavioral baselines and kill paths. Building an agent registry is crucial to identify and govern these assets.Agents must have their own identities, separate from developer tokens or shared service accounts, and this identity needs delegation context. Capabilities should be shrunk before behavior is inspected, using time-bound and task-limited access. Attribution must be fixed before automating enforcement, ensuring every tool invocation is linked to the agent, principal, and task.Finally, the gateway can effectively enforce policies once it has access to registered identities, delegation contexts, and telemetry. Detection and kill paths are developed last, after attributable agent activity is established. Organizations can begin by inventorying their production agents and testing attribution capabilities. Implementing this structured approach ensures robust agent security without disrupting existing systems.