MCP is turning AI agents into operational identities

At a glance

What this is: This is an analysis of how MCP is changing AI agents from narrow integrations into operational identities that can act across business and security systems.

Why it matters: It matters because IAM and governance teams now have to decide how to authorise, constrain, and monitor AI agents that initiate work rather than just respond to requests.

Context

MCP, or Model Context Protocol, is a standard way for AI agents to connect to tools, APIs, and data sources. In identity terms, that shifts the problem from integration to authorisation, because the agent is no longer a passive interface layer but an active executor with access to real systems.

The article’s core governance gap is that many programmes still assume access is granted to a stable actor with predictable usage. Once an AI agent can remember context, choose tools at runtime, and carry tasks across sessions, identity governance has to cover machine identity, privilege scope, and decision boundaries together.

For security operations teams, the practical question is not whether agents can speed up triage or documentation. It is whether existing controls can still explain who or what acted, why it had the authority, and how far that authority can spread when the agent is wired into multiple systems.

Key questions

Q: What breaks when AI agents use MCP without stronger governance?

A: Governance breaks when the organisation assumes access happens through a stable, inspectable human workflow. MCP-connected agents can retrieve data and trigger tool calls across many systems in one session, so blind spots emerge in discovery, classification, and audit. If policy, logging, and inspection are not agent-aware, the organisation cannot prove what was accessed or why.

Q: Why can AI create more security risk even when it improves defender productivity?

A: AI increases risk because it speeds both sides of the contest. Attackers can research targets faster, find weaknesses sooner, and scale social engineering, while defenders may accidentally leak sensitive data or accept inaccurate outputs as fact. The operational risk rises when teams trust model output without validation or allow unvetted data into tools that can later expose it.

Q: How should security teams monitor AI agents that use multiple business tools?

A: Monitor the tool path, not just the login. Teams need records of which tools were called, what data informed the action, and what system changes followed. That is the only practical way to separate legitimate delegation from misuse or prompt-driven abuse.

Q: What is the difference between agentic AI access and a normal automation script?

A: A script follows a fixed sequence. An agent can retain context, choose among tools, and decide when to continue or stop based on runtime conditions. That makes it an identity and governance problem, not just a workflow-engineering problem.

Technical breakdown

How MCP turns integration into identity-bearing access

MCP is a standard interface for connecting an AI agent to tools and data sources, which removes much of the custom glue code that previously limited agent usefulness. That matters because access is no longer a one-off API call into a single application. The agent can sequence actions across systems, read context from one source, and act in another, all while retaining enough memory to continue the workflow. From an identity perspective, the important shift is that the connector does not just move data. It extends operational authority into workflows that were previously separated by system boundaries.

Practical implication: treat each MCP connection as an authorisation boundary, not just an integration endpoint.

Why agent memory changes privilege governance

The article describes agents that remember yesterday, reuse context, and continue tasks between sessions. That is a different control problem from a script or scheduled job, because the decision to act is influenced by accumulated state rather than a fixed runbook. Traditional least-privilege models assume the privilege set can be defined at provisioning time. When an agent can carry learned context into future sessions, the real risk is privilege drift through accumulated task knowledge and cross-system reach. The governance challenge is not only what the agent can touch, but how its memory changes the next decision it makes.

Practical implication: scope agent permissions by workflow and context, not just by the system they connect to.

How AI agents create a lateral movement surface across business tools

The article’s examples show agents moving across email, calendar, Jira, Confluence, ticketing, and security platforms. That breadth matters because the same runtime access pattern can be used by defenders for productivity or by attackers for reconnaissance and chaining. An agent that can cross-reference documentation, read escalation history, and inspect detection gaps can also build a map of weak processes faster than a human operator. From an attack-path standpoint, MCP makes the tool graph more navigable. The security issue is not just data exposure. It is the speed at which contextual access can be repurposed into systematic abuse.

Practical implication: inventory the tool graph an agent can traverse and assume that graph is also an attack path.

Threat narrative

Attacker objective: The attacker wants to convert legitimate agentic access into a fast, cross-tool map of the organisation’s weak points and response patterns.

1. Entry occurs when an AI agent is granted MCP-connected access to email, ticketing, knowledge bases, and security tools as part of ordinary operational workflows.
2. Escalation follows when the agent uses that legitimate access to correlate detection gaps, escalation tickets, and internal process knowledge across multiple systems.
3. Impact comes when the same runtime access model is reused for systematic abuse, allowing adversaries to speed reconnaissance, social engineering, and lateral movement decisions.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP has turned AI agents into operational identities, not just smarter interfaces. The governance question changes once an agent can choose tools, carry context, and act across systems without a human in the loop. That is no longer an integration problem. It is a lifecycle and authorisation problem that identity teams must treat as part of core access governance.

The assumption that privilege is stable long enough to be reviewed breaks under agentic runtime behaviour. Access review and recertification models were designed for actors whose permissions persist long enough to be observed. When an agent can assemble, use, and discard access across a single workflow, the review artifact never forms in the first place. The implication is that governance has to move from periodic certification to issuance-time control and continuous decision traceability.

Identity blast radius is now defined by the tool graph, not the login event. A single agent that can move from email to ticketing to security telemetry can reveal process weaknesses faster than a human analyst and can also be abused to traverse them. That means IAM, PAM, and NHI governance can no longer be managed as separate silos when the runtime actor spans all three. Practitioners need to measure how far an agent can travel once trusted.

Context is becoming a security asset and a security liability at the same time. The article’s strongest insight is that the agent improves with memory, but so does the amount of organisational knowledge available to misuse. That creates a new governance obligation around what the agent is allowed to remember, reuse, and combine. Security teams should treat persistent context as part of the privileged surface.

Protocol standardisation is accelerating agent adoption faster than governance maturity. MCP lowers the friction for connecting agents to real systems, which is useful for defenders and equally useful for adversaries. Standards make scale possible, but they also compress the time available to build policy, logging, and offboarding discipline around machine actors. The category is moving from experimentation to operations faster than many identity programmes are ready for.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime governance for AI agents has become the real control plane. Once agents can move between business systems, the question is not whether they are clever enough to help. The question is whether access issuance, logging, and revocation follow the same path as the task itself, because static approvals will miss behaviours that unfold across multiple tools.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap means most programmes are still relying on human-era controls for machine-era access. The immediate programme risk is blind trust in context-rich agents that can act faster than governance cycles can respond.

Identity teams should expect MCP to make tool graphs more visible to both defenders and adversaries. The same connectedness that improves triage also reveals how much operational knowledge sits behind everyday systems. The next control layer is not another dashboard. It is a disciplined model for who or what may traverse those connections and under what conditions.

For practitioners

• Define MCP trust boundaries Map each MCP server, the tools it exposes, and the specific actions an agent can invoke through it. Then classify which combinations are read-only, case-management, or write-capable so access reviews can be based on function rather than platform name.
• Separate agent memory from execution rights Limit what an agent may retain across sessions and distinguish durable memory from active permissions. A workflow may need context persistence without retaining broad authority to reuse that context elsewhere.
• Instrument agent action traces Log which tool the agent selected, what context it used, and what changed in the target system. Without that trace, governance teams cannot explain whether a task outcome came from human intent, agent inference, or delegated automation.
• Review cross-system lateral movement paths Test the full path from email or ticketing to knowledge base, case management, and monitoring tools. If an agent can traverse all of them, an attacker using the same access pattern can build a rapid recon chain.

Key takeaways

• MCP is turning AI agents into actors that can cross tool boundaries, retain context, and execute work across business systems.
• The governance risk is not limited to productivity automation. It is the collapse of assumptions built around stable privilege, periodic review, and single-system access.
• Practitioners should control agent reach at the protocol boundary, trace every tool action, and treat cross-system traversal as a potential attack path.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Operational Identity Contact: An operational identity contact is the person or team responsible for receiving and acting on identity administration signals such as SSO setup, directory sync, or certificate renewal. It is not just metadata. It is part of the control plane because it determines who can respond when identity operations need intervention.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.