Before connecting an AI agent to workplace messaging and tools, decide which security decisions the surrounding software must enforce. Wirken, an existing open-source gateway featured by Help Net Security on November 9, offers a useful case study. Its documented limitations matter as much as its advertised controls.
The project documentation describes separate messaging-channel processes, an encrypted credential vault and container-based shell execution. Agents themselves share the gateway’s address space. Process separation for channel adapters should therefore not be mistaken for isolation of every agent.
Check whose approval carries forward
In a shared channel, a Tier 2 approval given by one sender applies to other senders using that agent and channel until it expires. Logging a person’s identity does not turn that approval into a personal entitlement.
Before a team pilot, document who can reach each agent and who is allowed to approve its actions. Use a harmless test action to check whether a second user inherits the first user’s approval, and inspect how approvals expire or are revoked. Compare the observed result with your access policy before attaching sensitive accounts.
Map every route to the internet
The project’s egress documentation explicitly separates tool-domain allowlists from a network boundary. Sandboxed shell execution has its own network settings, with no networking as the default. Stdio MCP servers are separately contained unless their configuration changes that posture.
HTTP MCP connections and the model-provider client take different paths. A stdio MCP server configured with sandboxing disabled also runs on the host. Tool-side domain rules do not constrain these connections; the documentation calls for operating-system network controls where those paths need restriction.
For a pilot, list the model endpoint, each MCP transport and every permitted destination. Keep sandboxing enabled and apply outbound firewall or container-network policy to the paths outside the tool allowlist. Verify denied destinations from each execution path rather than relying on a single successful blocking test.
Keep an audit anchor off the host
Wirken documents signed, hash-chained audit records. Their tamper evidence depends on a trusted key kept separately: an attacker running with the same operating-system identity could replace both local records and the local public key. Export records and retain the verification key outside the gateway before relying on the trail for incident review.
The README also says injection detection marks suspicious input rather than stopping it. Evaluate the permissions, containment and evidence retention as separate controls. A gateway can reduce exposure while still leaving important decisions to its operator.
