Agentic AI and MCP governance exposes a new identity security gap

At a glance

What this is: This is an analysis of how agentic AI and MCP are changing identity security, with the key finding that MCP is creating unmanaged non-human identity sprawl.

Why it matters: It matters because IAM, IGA, PAM, and security architecture teams now need to govern AI agents and MCP servers as identity-bearing actors rather than treat them as ordinary integrations.

By the numbers:

• Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
• 53% of MCP servers expose credentials through hard-coded values in configuration files.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read Unosecur's analysis of agentic AI governance and secure MCP access

Context

Model Context Protocol has moved from an integration detail to an identity problem. When AI clients can call tools, access live data, and execute workflows through MCP servers, every connection creates a new credential, a new trust boundary, and a new path for misuse. That is why MCP is now shaping the identity security conversation for agentic AI.

The governance gap is not just visibility. Enterprises are adopting MCP faster than they can establish centralized control, and traditional IAM assumptions break down when AI agents can act across tools with little auditability. The result is unmanaged non-human identity sprawl that affects both security operations and compliance programmes.

For agentic AI, the issue is not whether the system is intelligent enough to be useful. The issue is whether its access can be scoped, observed, and revoked with the same discipline expected for other non-human identities. That is the question this article raises, and it is the right one for security teams to ask.

Key questions

Q: How should security teams govern MCP-enabled AI assistants that can act on tools and data?

A: Treat MCP-enabled assistants as non-human identities with scoped authority, not as passive interfaces. Put a policy decision point between interpretation and execution, require explicit confirmation for privileged actions, and restrict which context sources the assistant may trust. Governance should focus on preventing unverified input from becoming executable intent.

Q: Why do MCP environments create more identity risk than standard API integrations?

A: MCP environments increase identity risk because they add tool discovery, delegated access, and multiple authentication paths on top of existing APIs. Every new tool expands the number of trust relationships and audit points. That makes lifecycle management, policy consistency, and observability harder to maintain than in a simpler API integration model.

Q: What do security teams get wrong about least privilege for agentic systems?

A: They often scope access as if the agent’s purpose is fixed at provisioning time. In practice, agent intent can shift during execution, especially when tools, memory, or external content influence behaviour. Least privilege has to be task-bounded, not role-bounded, and must be reassessed when the agent’s context changes.

Q: How do compliance teams prove what an AI agent accessed through MCP?

A: They need session logs that connect authentication, token use, tool calls, and resulting actions into one audit trail. If each tool logs in isolation, you lose chain of custody and cannot reconstruct the agent’s behaviour with confidence. That creates a gap for incident response, audit, and regulated reporting.

Technical breakdown

How MCP turns tool access into identity exposure

MCP connects AI clients to tools and data sources through authenticated sessions that often behave like ordinary integrations, but with agent-driven execution layered on top. Each server may carry its own secrets, scopes, and trust assumptions, which makes the protocol an identity distribution layer as much as a tooling layer. The security issue is that access is no longer static or centrally mediated in many deployments, so every new connection can expand the effective identity surface.

Practical implication: treat every MCP server as an identity-bearing integration that needs explicit scoping, logging, and revocation paths.

Why persistent credentials are the weak point in MCP

The article describes persistent credentials, weak rotation, and minimal auditability as the dominant pattern in current MCP deployments. That combination is risky because agentic workflows amplify the value of any long-lived secret: once an agent or connected tool can reuse a credential, the access path can outlive the original task. In practice, the protocol can inherit all the old problems of service-account sprawl while adding a faster execution layer on top.

Practical implication: eliminate long-lived tokens where possible and tie MCP access to short-lived, task-scoped authorization.

Why task-based access control matters for agentic workflows

The move from static roles to activity- and task-based access control reflects a broader shift in how non-human identity should be governed. MCP traffic is not a single user session in the human sense, so role-only models often overgrant or underobserve. Granular control over tool calls, session state, and token use becomes the practical way to constrain what an agent can do without assuming it will behave like a fixed application account.

Practical implication: map MCP permissions to tasks and tool scopes, then verify that read and write actions are separated where business logic allows.

Threat narrative

Attacker objective: The objective is to make the agent carry out harmful actions through legitimate access paths while evading conventional detection.

1. Entry occurs when an attacker embeds malicious instructions in a trusted tool description, configuration file, or other content source that an agent already consumes.
2. Escalation follows when the agent uses legitimate credentials or approved tool access to locate secrets, invoke APIs, or perform actions the operator did not intend.
3. Impact appears when the agent exfiltrates credentials, modifies systems, or propagates malicious actions through otherwise authorised workflows.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP is now an identity expansion event, not an integration detail. Once an AI system can choose tools, call APIs, and act on live data, the security problem moves from application connectivity to identity governance. That means security teams must classify MCP servers and AI clients as governed non-human identities, not as passive middleware. The practical conclusion is that identity architecture, not model capability, becomes the control plane.

Persistent credentials are the wrong operating assumption for agentic access. The article’s core weakness list, persistent credentials, weak rotation, and minimal auditability, shows that MCP deployments still rely on access patterns built for stable service accounts. That assumption breaks when agentic systems can execute quickly, chain actions, and expose secrets in motion. The implication is that lifetime-based trust is becoming structurally unsound for AI-driven access.

Task-based access control is the right direction, but only if it is enforced at the identity layer. Activity and task scoping can reduce standing access, but only when token use, session state, and tool permissions are all governed together. Otherwise teams end up with policy language that sounds dynamic while the underlying credentials remain persistent. Practitioners should treat MCP governance as an identity design problem, not a policy overlay.

Unmanaged MCP sprawl creates a chain-of-custody problem for compliance as well as security. When teams cannot reliably say which servers are trusted, which tools were called, or which data moved through an agent session, auditability fails even if no overt incident occurs. That weakens evidence collection for regulated environments and complicates incident reconstruction. Security leaders should assume that traceability gaps will become the first operational blocker, not the last.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That governance gap widens quickly as agent populations grow, so practitioners should pair policy design with a measurable control model and OWASP Agentic AI Top 10 alignment.

What this signals

Agentic identity governance will increasingly be measured by audit completeness, not policy intent. If teams cannot reconstruct which tools an agent touched, which token it used, and what data moved, then the programme is not ready for regulated use. With 48% of organisations still unable to track and audit the data their AI agents access, the control gap is already operational, not theoretical, according to AI Agents: The New Attack Surface report.

Identity blast radius is the concept practitioners should now track. The question is no longer whether an agent can be useful, but how far its legitimate access can extend before a human can intervene. That makes session scoping, token lifetime, and tool segregation more important than model selection for most enterprise deployments.

The near-term programme risk is unmanaged scale. As AI agents become embedded in workflows, teams will need to align their controls with the OWASP Top 10 for Agentic Applications 2026 and decide where approval gates remain mandatory.

For practitioners

• Inventory every MCP server and AI client Build a complete register of MCP endpoints, the credentials they use, the tools they expose, and the data sources they can reach. Include cloud, SaaS, on-prem, and developer workflow connections so you can see where identity is being extended without central approval.
• Replace persistent secrets with short-lived access Move MCP access toward short-lived tokens, task-scoped permissions, and explicit revocation paths. Prioritise any server or workflow that still relies on hard-coded values, shared credentials, or long-lived bearer tokens.
• Separate read and write authority for agent workflows Define distinct permissions for data retrieval, system modification, and external transmission. Where the business process allows, prevent a single agent session from both discovering sensitive data and acting on it.
• Centralise session and token telemetry Track authentication events, token use, tool calls, and execution outcomes in a single audit stream. Without that telemetry, it becomes difficult to prove who or what accessed a system, especially when an agent is acting across multiple tools.
• Apply manual approval gates to high-risk actions Keep humans in the loop for actions that modify production systems, reveal credentials, or move data outside the original trust boundary. Use approval gates selectively, focused on the highest-impact operations rather than every routine agent step.

Key takeaways

• Agentic AI and MCP are expanding the identity perimeter faster than most IAM programmes can govern it.
• Persistent credentials, weak rotation, and poor auditability are the structural weaknesses that make MCP deployments risky.
• Security teams need task-scoped access, centralised telemetry, and explicit approval boundaries to keep agentic access controllable.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• A step-by-step description of the secure MCP Gateway architecture and how it handles authentication and authorization.
• Operational examples of session and token tracking across MCP traffic, including the telemetry teams would need for investigations.
• The specific policy manager and JIT control flows used to enforce task-based access in agentic workflows.
• The article’s mapping of these controls to OWASP Agentic Threat Model concerns such as tool misuse and privilege compromise.

👉 Unosecur's full blog covers the MCP gateway model, policy controls, and agentic identity governance details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.