Session Description
Your AI coding agents can now connect to any MCP tool server , databases, Slack, Jira, cloud APIs. Security teams review the tool. But nobody reviews the thousands of actions the agent takes through that tool at runtime. One bad tool call exfiltrates customer PII to a Slack channel, and your GRC review never saw it coming.

Portcullis is an open-source MCP stdio proxy (~280 lines of Go) that intercepts every tool call an agent makes, classifies it by data sensitivity (DCL tagging), tracks session taint across calls (if you touched Confidential data, your session is now tainted), and evaluates every action against OPA/Rego policy , all in under 2ms. The agent never knows enforcement is happening.

This is a live-demo talk. I will show: an agent reading a Confidential customer record, then attempting to post to Slack , and getting blocked because the session is tainted. Same session, same taint, but a Jira write succeeds because internal tools are allowed. GRC changes the policy by editing one Rego file. Zero deployments. Zero agent code changes.

Key Learnings
• Why tool-level review fails at runtime , the gap between approving a tool and controlling what an agent does with it
• How session taint propagation catches indirect data exfiltration that argument-level inspection misses
• Building a policy-as-code enforcement layer for MCP using OPA/Rego with <2ms evaluation latency
• Separating GRC policy ownership from developer tool connectivity , the 'blank cheque' model
• Open-source architecture walkthrough: Go proxy, Rego policies, audit trail, zero external dependencies