MCP and agentic AI security: why contextual access is now essential

At a glance

What this is: This is a blog analysis of MCP and agentic AI security that says contextual access is now essential because agents can act beyond human-style discretion and exploit broad, stale authorizations.

Why it matters: It matters because IAM teams now have to govern tool discovery, task-time authorisation, and context drift for AI agents, not just authenticate users and issue static entitlements.

Context

MCP and agentic AI security are increasingly about whether access decisions can keep up with runtime behaviour. Traditional IAM assumptions often treat identity as a stable subject with predictable intent, but agentic systems can probe, reuse, and chain actions in ways that make static authorisation too blunt for the task.

The governance gap is not simply that AI is faster. It is that enterprise access models were built around human discretion and persistent entitlements, while MCP can turn an AI agent into a tool-using actor that needs scoped, time-bound, context-aware access. That shift changes the control point from standing permission to issuance-time decisioning.

Key questions

Q: What breaks when MCP agents are given broad permissions?

A: Broad permissions turn one compromised or manipulated agent into a wide-blast-radius identity. The agent can read, write, and trigger actions beyond the original workflow, which makes tool poisoning, credential theft, and accidental misuse far more damaging. Least privilege is the control that limits how far the delegation chain can spread.

Q: Why do contextual access controls matter more for agentic AI than for ordinary users?

A: Contextual controls matter because agentic systems make decisions at runtime and can use tools in sequences that no static role model can predict. Time, device, task, and business condition all become part of the access decision, not just the login event.

Q: What are the warning signs that an MCP deployment is overexposing enterprise tools?

A: Warning signs include overly broad tool discovery, agents reaching adjacent data without a fresh policy check, and responses being reused after user permissions change. Those symptoms show the protocol is enabling reach faster than the governance model can constrain it.

Q: How should teams think about Zero Standing Privilege for AI agents?

A: Zero Standing Privilege should be treated as a runtime decision model for non-human actors, not a one-time hardening choice. The goal is to ensure every agent action is re-authorized for the current task so access never persists longer than the need that justified it.

Technical breakdown

Why MCP changes the authorisation model for AI agents

MCP gives agents a standard way to discover tools and reach enterprise systems, which means the security problem moves from simple authentication to authorisation at the moment of use. In a human-centric model, a user is granted a role and then acts within broad expectations. An agent, however, can iterate through options, query adjacent data, and continue until it finds a path that satisfies its objective. That behaviour makes stale entitlements especially risky because the protocol amplifies reach, not just connectivity.

Practical implication: Treat tool exposure as an authorisation decision, not a catalog problem.

Zero Standing Privilege and contextual access for agentic AI

Zero Standing Privilege means access is not pre-assigned and left active. Instead, it is evaluated in context each time the agent or user needs it. For MCP use cases, that context can include task, identity, device posture, location, and business condition. The security value is not only reducing standing access, but also shrinking the blast radius if an agent retains a prior response or inherits more access than the current task justifies.

Practical implication: Make every agent request pass a fresh, contextual policy check before execution.

Why tool discoverability is now a governance problem

Tool discovery is useful for flexibility, but it can also surface functions that a user or agent should never have known existed. If the list-tools step is not itself authorised, the agent can discover and potentially invoke more than intended. When execution occurs under the server's privilege instead of the requesting identity, auditability weakens and downstream accountability becomes murky. This is a protocol-level governance issue, not just a logging issue.

Practical implication: Authorize tool discovery and preserve the requesting identity through execution and audit trails.

Threat narrative

Attacker objective: The objective is to expand agent reach inside enterprise systems until sensitive information or protected workflows become discoverable through contextual misuse.

1. Entry occurs when an AI agent is connected to MCP-enabled systems that expose enterprise tools and data to runtime interaction.
2. Escalation follows when the agent repeatedly probes alternative paths, reuses prior responses, or reaches broader data than the current task warrants.
3. Impact is the discovery or disclosure of sensitive information and the expansion of effective access beyond what a human operator would have been granted in the same situation.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Contextual access has become the control plane for agentic AI. Once MCP connects agents to enterprise tools, the old assumption that broad roles are acceptable until reviewed stops holding. Access must be judged at issuance time, because the agent's usefulness depends on runtime context rather than stable human intent. The practitioner conclusion is that authorisation now has to be continuous, externalized, and policy-driven.

Zero standing privilege is not a hardening tactic for agents, it is the minimum viable trust model. Standing access assumes a subject will behave predictably long enough for static entitlements to remain safe. That assumption weakens when an agent can sequence actions, revisit prior responses, and keep working after the original business condition has changed. Practitioners should treat lingering privilege as an active governance failure, not an operational convenience.

Tool discovery without identity-aware gating creates hidden blast radius. MCP makes it easy for an agent to find capabilities that were never meant to be universally visible. That is a structural governance issue because discoverability itself expands the attack surface before any command is issued. Security teams need to think about what the agent can learn as well as what it can execute.

Context becomes part of identity when AI systems can reuse information across steps. If an agent sees data once, it may retain that knowledge even after the user's access should narrow. This means time, device, task, and role changes are no longer peripheral signals but core authorisation inputs. The field should stop treating context as an add-on and start treating it as an access boundary.

Agentic AI security is forcing IAM to move from entitlement management to decision management. The central issue is no longer who has a role in the abstract, but whether a system can make precise, ephemeral decisions for a non-human actor in motion. That shift aligns with OWASP-NHI concerns about overprivileged and long-lived access, while also extending into agentic risk. Practitioners should expect governance to follow the decision moment, not the provisioning event.

From our research library:

• Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
• Read next: Agentic AI Identity Guide

What this signals

Context is becoming the new access boundary for agentic systems. Teams that still treat authorisation as a one-time entitlement will miss the real control point, which is the current task and the current environment. When an agent can reuse prior responses, the boundary moves from provisioning to issuance, and governance has to follow that shift.

Identity programmes need to separate discovery from execution. MCP-style tool exposure can reveal capabilities before they are actually needed, so the policy question is no longer only whether an action is allowed. It is also whether the agent should be allowed to know the action exists in the first place.

Governance built for static roles will keep underestimating agentic AI risk. The 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that scale change means contextual access decisions will move from edge case to mainstream operating requirement, according to Gartner research cited by SGNL.

For practitioners

• Enforce contextual authorisation at request time Require every agentic AI request through MCP to be evaluated against current task, identity, device posture, location, and business condition before any tool call is executed.
• Remove standing access from agent workflows Replace persistent entitlements with Zero Standing Privilege so the agent only receives the minimum access needed for the current task and only for that moment.
• Gate tool discovery separately from tool use Authorize the list tools path and similar discovery methods so agents cannot enumerate functions or data surfaces they were never meant to know about.
• Preserve requesting identity through execution Ensure the requesting user or agent remains visible in logs, traces, and downstream calls so execution never collapses into server-level privilege without attribution.
• Review cache and response reuse assumptions Check whether agents can retain prior responses after the user's permissions change, because reused context can outlive the access condition that originally justified it.

Key takeaways

• MCP changes the security problem from user login to runtime authorisation for AI agents that can probe, discover, and reuse access paths.
• Static entitlements and broad tool visibility increase blast radius because agent behaviour is goal-driven rather than discretion-driven.
• The practical response is contextual access, Zero Standing Privilege, and identity-aware gating of discovery and execution.

Key terms

• Contextual Access Control: Contextual access control changes access decisions based on factors such as device posture, application risk, location, or data sensitivity. In cloud security, it helps move access policy from static entitlements toward decisions that reflect the actual conditions of use.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Tool discovery: The process by which an AI agent learns what functions or actions are available to it at runtime. It becomes a security issue when discovery is broader than entitlement, because the agent can map capabilities even when it should not be able to use them.
• Ephemeral authorization: A short-lived permission model that grants access only for the immediate task and expires quickly. It reduces the chance that an AI agent or service account can reuse an earlier decision after the task changes, which is a common source of NHI blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.