MCP breaks zero trust by shifting control into execution

At a glance

What this is: This analysis argues that MCP creates a control gap by moving AI actions into an execution layer that traditional zero trust and IAM do not govern well.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to evaluate not only who or what can connect, but whether an AI-driven action should be allowed to execute at all.

👉 Read AppSOC's analysis of MCP, zero trust, and AI agent execution risk

Context

Model Context Protocol, or MCP, standardises how AI agents connect to tools and data sources. The governance problem is that standardisation can turn dynamic tool use into a trusted execution path before security teams have defined who owns the permissions, the workflow, and the decision to act. That is why MCP security is now a zero trust issue, not just an AI integration issue.

For identity programmes, the question is no longer limited to account provisioning or API access. It is whether an agent, working inside an approved workflow, can reach tools, select actions, and trigger downstream systems with insufficient context checks. That places MCP at the intersection of NHI governance, agentic AI oversight, and privileged execution control.

Key questions

Q: How should security teams govern AI agents that use service accounts and MCP tools?

A: Start with ownership, then add runtime attribution and containment. Security teams should know which human deployed the agent, which identity the agent uses, what tools it can invoke, and when to revoke access. If the agent can chain tool calls or spawn sub-agents, governance must cover those paths as well, not just the initial login.

Q: Why do MCP and zero trust conflict in agentic environments?

A: They conflict because zero trust primarily answers whether an identity may access a resource, while MCP can turn that access into an execution path. In agentic environments, a trusted internal request may still be unsafe if the agent was manipulated, over-scoped, or allowed to chain actions without review. The missing layer is runtime judgment.

Q: What breaks when AI agent tool use is treated like normal API traffic?

A: What breaks is the ability to judge intent and impact. API traffic controls can confirm that a call was made, but they do not determine whether the call made sense in context, whether the data was sensitive, or whether the workflow had been hijacked. That leaves unsafe agent actions looking legitimate until after damage occurs.

Q: Who is accountable when an AI agent takes action through an MCP server?

A: The accountable party is the human or team that authorised the agent's access, but only if the organisation can prove that chain. Without immutable logs that connect the initiating identity to the tool call and final action, accountability becomes weak, and legal or compliance teams lose the evidence they need.

Technical breakdown

Why MCP becomes an execution plane

MCP is not just another integration standard. It defines a common way for agents to discover and invoke tools, which means the protocol can shift security enforcement from access authorization to runtime execution. In practice, that creates a path from model reasoning to system action that may bypass the controls IAM teams expect to sit in front of sensitive systems. When an agent can dynamically choose tools and invoke them through MCP, the control question is not simply whether the identity is valid. It is whether the action itself is safe, scoped, and traceable.

Practical implication: Treat MCP-enabled tool invocation as an execution control problem, not only an authentication problem.

Why zero trust leaves a gap for AI agents

Zero trust assumes continuous verification of identities, devices, and context before access is granted. That works well when a human or predictable service requests a resource, because the request can be evaluated against static privilege, posture, and policy. AI agents complicate this model because they do not merely request access. They decide which tool to use, when to use it, and what chain of actions to follow. Traditional policy engines can validate the requester, but they rarely understand the semantic intent of the action or whether that action was shaped by malicious input.

Practical implication: Extend zero trust decision points to include action intent, not just requester identity and device posture.

How runtime guardrails change the control model

Runtime guardrails sit between agent intent and downstream execution, where the highest-risk decisions actually occur. They need to inspect the tool call, the context, the data classification, and the operational impact before the action reaches the target system. That is a different control layer from static allowlists or network filtering, because the risk is often inside a legitimate workflow. In agentic environments, the control stack must understand that a trusted internal request can still be an unsafe action if the agent has been manipulated, over-scoped, or allowed to chain tools without review.

Practical implication: Place policy enforcement at the agent-to-tool boundary so unsafe actions can be blocked before they execute.

Threat narrative

Attacker objective: The attacker wants to use a trusted agent execution path to reach tools and data that existing zero trust controls do not adequately govern.

1. Entry occurs when an AI agent reaches an MCP server through a trusted internal workflow or approved integration path.
2. Escalation happens when the agent dynamically discovers over-permissioned tools or accepts malicious input that alters the action path.
3. Impact follows when the agent invokes downstream systems, exfiltrates data, or manipulates workflows before security teams can intervene.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero trust breaks when the security model stops at access and never reaches execution. MCP does not just connect agents to tools, it creates a trusted path from decision to action. That is a structural problem for IAM and PAM models that were built to authorise requests, not to inspect the meaning of machine-initiated actions. Practitioners need to recognise that the control boundary has moved.

Context-aware enforcement is now a governance requirement, not an optimization. If an agent can choose tools dynamically, then least privilege defined at provisioning time is no longer enough to describe the real risk. The relevant question becomes whether the action is appropriate given the data, system criticality, workflow state, and input provenance. That is why runtime policy must sit at the execution layer, not around it.

Shadow AI becomes more dangerous when it can invoke tools through a standard protocol. Discovery is no longer the only problem, because hidden agents can now inherit a path to downstream systems through MCP servers that were never fully inventoried or reviewed. The governance gap here is not merely visibility. It is the absence of an authoritative control point for agent-to-tool behaviour. Practitioners should treat unknown MCP servers as unmanaged NHI infrastructure.

Identity governance has to move from who can connect to what actions can execute. Traditional IAM answers the caller question, but agentic environments require a second layer that evaluates intent, context, and impact before execution. That means the discipline now spans IAM, NHI governance, and agent behaviour oversight. Teams should reframe policy design around execution rights, not just account rights.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That visibility gap is why the OWASP Top 10 for Agentic Applications 2026 matters for practitioners who need to control tool use, prompt injection, and agent identity abuse.

What this signals

Runtime governance will become the deciding factor for agentic security programmes. As agent adoption grows, teams will need controls that evaluate actions at execution time, not just identities at login. That shift should push security architects toward policy enforcement points that sit inside the agent workflow and toward stronger inventory discipline for every MCP server and connected tool.

Context no longer behaves like a nice-to-have control layer. When an agent can translate a prompt into an operational action, the programme needs to know data sensitivity, system criticality, and input provenance in real time. Existing IAM reviews and access certification cycles will not catch a bad action if the action is completed before the review window opens.

Identity teams should prepare for a broader control boundary across NHI, PAM, and agent oversight. The practical consequence is that the next wave of governance will look less like static entitlement management and more like behavioural approval for machine-initiated execution. That is why the relevant baseline is already visible in the Ultimate Guide to NHIs , 2025 Outlook and Predictions, where lifecycle, scope, and ownership remain the core governance questions.

For practitioners

• Inventory MCP servers and connected tools Build a complete list of MCP servers, tool permissions, and agent-to-tool paths. Unknown or unreviewed servers should be treated as unmanaged NHI infrastructure until proven otherwise.
• Insert policy checks at execution time Enforce contextual approval at the moment a tool call is made, using data sensitivity, workflow state, and system criticality as policy inputs.
• Define ownership for agent actions Assign accountable owners for each agent workflow, each MCP server, and each downstream system the agent can reach. Without clear ownership, no one can attest that a tool invocation was appropriate.
• Separate trusted transport from trusted action Do not treat an internal workflow or approved integration as sufficient justification for execution. Require explicit evaluation of whether the requested action is safe, even when the transport is authenticated.

Key takeaways

• MCP changes the control problem by moving AI from access into execution, where traditional zero trust and IAM checks are weaker.
• The evidence points to a growing governance gap, with agent behaviour already exceeding intended scope in most organisations.
• Practitioners need runtime policy, ownership, and action-level evaluation if they want AI systems to remain governable.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Execution Layer: The execution layer is the operational point where identity policy becomes system change. It is where approvals, provisioning, revocation, and session controls either complete successfully or fail in ways that create drift. For practitioners, this is where governance is proven, not merely documented.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.

What's in the full article

AppSOC's full analysis covers the operational detail this post intentionally leaves for the source:

• How its MCP Security Gateway places enforcement directly inside the agent-to-tool interaction layer.
• How runtime guardrails inspect requests and responses in real time before downstream execution.
• How contextual policy enforcement uses business context, asset criticality, and operational requirements.
• How the platform surfaces shadow AI and hidden MCP risk across agents, servers, and connected tools.

👉 AppSOC's full post covers the MCP control gap, runtime guardrails, and contextual policy enforcement in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building identity security capability across human, machine, and autonomous systems, it is worth exploring.