MCP is evolving into an agent operating layer, not just tools

At a glance

What this is: MCP is expanding from a function-calling protocol into a broader agent workflow layer, with Tasks, Apps, enterprise authorization, and Skills changing how agents operate in enterprise environments.

Why it matters: IAM, NHI, and agentic AI teams need to reassess how identity, authorization, and governance work when protocol primitives begin to carry long-running work and enterprise access decisions.

By the numbers:

• Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
• 53% of MCP servers expose credentials through hard-coded values in configuration files.

👉 Read Aembit's analysis of how MCP is evolving beyond tool calling

Context

MCP started as a standard way for language models to call external functions, but the protocol is now being shaped into something broader: a runtime layer for agent work, long-running tasks, and enterprise deployment. That matters because MCP is no longer just a transport problem; it is becoming an identity and governance problem for the systems that use it.

The practical question for security teams is not whether MCP can support more features, but whether enterprise IAM and NHI controls can still make sense when agent activity is split across tasks, interactive UI flows, reusable skills, and centrally managed authorization. The article points to a future where the protocol itself becomes part of the control plane for agent behaviour, which is a very different governance posture from simple tool calling.

For teams already treating MCP as an emerging part of the agentic stack, this is a typical progression, not an edge case. Protocols that begin as integration glue often become the place where identity, policy, and operational accountability collide.

Key questions

Q: How should teams govern MCP when it starts carrying long-running agent work?

A: Treat long-running MCP work as a governed execution state, not a simple API call. Security teams should define ownership, expiry, cancellation authority, and logging for each task so work cannot continue outside the intended policy boundary. That approach matters because the protocol is shifting from transient tool use toward durable agent operations.

Q: Why does enterprise-managed authorization matter for MCP deployments?

A: It matters because agents do not behave like one-off user sessions. If an organization wants agents to access systems under defined conditions, then central policy, auditability, and revocation must apply to the agent identity itself. Without that, MCP becomes another path to broad, poorly governed non-human access.

Q: Where do MCP server deployments most often fail in practice?

A: They fail when tool permissions are too broad and credentials are embedded in configuration files or otherwise left without clear access scoping. That creates an easy path from protocol access to downstream system access. Teams should assume any unscoped MCP deployment can become a standing privilege problem.

Q: What is the difference between MCP Tasks and a normal API request?

A: A normal API request ends with the response, but an MCP Task can continue as a durable work object that the client can check, update, or cancel later. That makes Tasks operationally useful, but it also means the task lifecycle needs the same governance attention as a privileged session.

Technical breakdown

Tasks and long-running agent work in MCP

Tasks are an official MCP extension that let a server return a task handle instead of forcing the original request to stay open. That changes the execution model from synchronous tool use to resumable work, where the client can check status, update the task, or cancel it later. The architectural significance is that the unit of work becomes durable and inspectable, which is closer to workflow orchestration than traditional request-response API use. It also introduces lifecycle questions around persistence, expiry, and state handoff that are central to enterprise governance.

Practical implication: treat task handles as governed identities for work execution, with explicit expiry, ownership, and cancellation controls.

MCP Apps and server-rendered interfaces

MCP Apps let servers present interactive HTML interfaces that hosts can render alongside tool interactions. Instead of agents only exchanging structured tool results, the protocol can support buttons, forms, and other human-in-the-loop elements inside the same operational flow. That makes the protocol more expressive, but it also widens the trust boundary, because the server is now shaping not just data returned to the agent but the interaction pattern itself. For security teams, this introduces interface trust, input handling, and decision handoff as part of the identity problem, not just the UX problem.

Practical implication: review server-rendered interfaces as part of agent trust boundaries, not as cosmetic front ends.

Enterprise-managed authorization and agent identity

The article’s enterprise-managed authorization model shifts access from per-user, per-server arrangements toward centrally governed agent identity. That is important because it recognises that agents often act under enterprise authority rather than a single human’s session. In identity terms, this is an NHI governance pattern: the enterprise needs to know which agent can reach which system, under what conditions, and with what accountability. The protocol direction suggests that authorization is becoming native to the agent runtime, which raises the bar for lifecycle management, scoping, and auditability.

Practical implication: align MCP access with NHI governance controls, including scoping, review, and centralized audit trails.

Threat narrative

Attacker objective: The attacker aims to turn an agent workflow layer into a durable path for unauthorized access, data exposure, or tool misuse across enterprise systems.

1. Entry begins when an MCP deployment exposes tool permissions too broadly or stores credentials in configuration files, creating an accessible path into the agent workflow environment.
2. Escalation occurs when the agent or an attacker uses reusable protocol primitives, long-running tasks, or weakly scoped access to expand beyond the original intended action boundary.
3. Impact follows when the agent can reach enterprise systems with insufficient governance, making unauthorized data access, tool misuse, or credential exposure materially easier.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP is becoming an identity layer before it becomes an operating layer. The article’s real significance is not that MCP can do more, but that it is beginning to carry enterprise access decisions, long-running work, and structured agent behaviour. That moves it out of the category of simple integration plumbing and into the category of governed non-human identity infrastructure. Practitioners should treat MCP design choices as identity architecture choices, not just developer ergonomics.

Centralised authorization for agents changes the governance model, but it does not remove the need for lifecycle controls. If an enterprise says an agent can access systems under defined conditions, then scoping, review, revocation, and accountability all become part of the same control plane. The protocol can help express the policy, but governance still depends on whether identities are reviewed, removed, and constrained with the same discipline as other NHIs. Practitioners should align MCP governance with OWASP-NHI and NIST CSF expectations.

Tasks create a durable work object that security teams must govern like a privileged session. A task handle is not just a technical convenience; it is an execution token for work that may outlive the initiating request. That means organizations need to think about ownership, expiry, state transfer, and cancellation as first-class control issues. Durable work object governance: the moment work can continue after the original request closes, access review assumptions based on short-lived sessions start to weaken. Practitioners should map task lifecycle controls to identity governance, not just application workflow.

Skills formalise agent procedures, which reduces improvisation but increases policy dependence. Reusable skills sound operationally tidy because they package prerequisites, side effects, and escalation paths, but they also create a new dependency on curated, trustworthy procedure metadata. The governance question becomes whether the skill catalog is controlled like a privileged workflow library or left as a convenience layer. Practitioners should assume skills become part of the enterprise’s identity and authorization surface.

MCP’s trajectory confirms that agentic AI security is converging with NHI security. The article shows the protocol moving toward long-running work, interface mediation, and enterprise-managed access, all of which require the same discipline used for service accounts, tokens, and workload identities. The industry is not heading toward a separate agent security discipline that replaces NHI governance. It is heading toward a unified governance model where agent behaviour is one more non-human identity problem to control. Practitioners should plan for that convergence now.

From our research:

• Only 18% of MCP server deployments implement any form of access scoping for tool permissions, according to Astrix Security.
• 53% of MCP servers expose credentials through hard-coded values in configuration files, according to Astrix Security's research.
• For a wider agent-risk view, AI Agents: The New Attack Surface report shows that 80% of organisations have already seen AI agents act beyond intended scope.

What this signals

Durable agent work will force IAM teams to think in terms of execution state, not just login state. MCP Tasks, reusable skills, and centrally managed authorization all point to a future where the control point is the work unit itself. That is why protocol governance and identity governance are converging. Teams that already track service accounts, tokens, and workload access should extend the same discipline to agent workflows, then anchor the design against the OWASP Top 10 for Agentic Applications 2026.

Access scoping will become the differentiator between safe pilot deployments and operational risk. If only a small share of MCP deployments scope tool permissions properly, then the near-term issue is not feature maturity but basic control coverage. The strongest signal a programme is maturing is not how many tools it can reach, but whether it can prove which agent may use which tool under which policy, with evidence that survives audit and incident review.

Agent identity and enterprise authorization are no longer future requirements. The roadmap direction suggests that organizations should prepare for policy expression, lifecycle review, and revocation to happen at the protocol layer as well as in IAM tooling. That means the next wave of MCP adoption should be evaluated through an NHI lens, with task handles, skills, and server-rendered interactions treated as governed identity objects rather than convenience features.

For practitioners

• Map MCP primitives to identity controls Classify Tasks, Apps, Skills, and enterprise authorization as governed identity surfaces, then assign ownership for scoping, review, revocation, and audit trails across each one.
• Treat task handles as privileged execution state Set expiry rules, cancellation authority, and state-transfer logging for every long-running task so work cannot persist beyond the intended control boundary.
• Review server-rendered interfaces for trust leakage Assess MCP Apps for embedded actions, hidden assumptions, and user interaction paths that could bypass normal identity and approval checkpoints.
• Align agent authorization with NHI lifecycle governance Use centralized policy to define which agents may access which systems, then include those agents in periodic access review and offboarding workflows.
• Inventory reusable skills before they become shadow procedure libraries Require metadata ownership, change control, and validation for every reusable skill so procedure reuse does not turn into unmanaged operational privilege.

Key takeaways

• MCP is evolving into a governed agent workflow layer, which makes identity and authorization controls more important than tool connectivity alone.
• Long-running tasks and reusable skills create durable execution objects that need ownership, expiry, and auditability.
• Teams that already manage NHIs should extend the same lifecycle discipline to agent identities, because protocol growth does not reduce governance risk.

Key terms

• Tasks extension: An MCP extension that lets a server return a task handle for work that continues after the original request. In governance terms, it creates a durable execution object that can be checked, updated, or cancelled, which means lifecycle, expiry, and ownership controls matter as much as the task itself.
• Enterprise-Managed Authorization: Enterprise-managed authorization is a policy model in which the identity provider decides what an agent may do and encodes that decision into the token or access flow. It helps organisations keep control logic centralized instead of spreading entitlement decisions across many servers.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agent Workflow: An agent workflow is a machine-driven sequence where an AI system can call tools, access data, and continue execution with limited human involvement. These workflows need governance that sees API activity and tool use, not just browser sessions or user clicks.

What's in the full article

Aembit's full article covers the operational detail this post intentionally leaves for the source:

• The roadmap language behind Tasks, including retry behaviour, result expiry, and long-term state handling.
• How MCP Apps and server-rendered interfaces change the interaction model for agents in production.
• The experimental Skills work, including discovery, metadata, and composition considerations.
• The enterprise-managed authorization direction and why agent identity is becoming a first-class concern.

👉 Aembit's full post covers the roadmap, Tasks, Skills, and enterprise authorization in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.