TL;DR: Enterprise MCP adoption is concentrating around Slack, Google Workspace, Snowflake, Datadog, GitHub, Notion and Granola, according to Aizome's analysis of Runlayer usage data, creating persistent trust relationships that most identity and security stacks cannot see. The governing assumption breaks when session-level tool use outruns review-based controls.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Aizome's blog post: Enterprise MCP adoption is concentrating governance risk in persistent agent-to-system sessions that most identity controls cannot observe.
Why it matters: IAM, PAM and NHI teams need to treat MCP sessions as governed access paths, because authenticated agent activity inside the session can outrun what existing visibility tools can explain.
By the numbers:
- Every MCP connection in the top 10 shares persistent trust, broad data access and action capability, creating a governance surface that traditional controls do not evaluate in-session.
Context
MCP creates a governance gap because the trust decision happens once, but the agent can keep using that session to call tools, read data and trigger actions long after the initial authentication event. That makes the control problem less about login and more about what is permitted inside an active agent-session boundary.
For identity programmes, the key issue is that existing visibility layers usually separate authentication from behaviour. An identity provider can confirm the session started, but it does not explain which resources the agent touched, which instructions it followed, or whether the session stayed within its intended scope. least privilege for AI agents needs to extend into the tool-call layer.
Key questions
Q: How should teams govern AI agents that use MCP?
A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.
Q: Why is persistent session access risky for AI agents?
A: Persistent session access is risky for AI agents because a long-lived login or token lets the agent keep acting after the original task, approval or supervision has ended. If the session is reused, stolen or over-scoped, the agent can read data, call tools and make changes with the original identity’s privileges until revocation, expiry or step-up reauthentication cuts it off.
Q: How do collaboration tool integrations expand an agent's blast radius?
A: Collaboration tool integrations expand an agent's blast radius by giving it access to chats, files, calendars, tickets and shared workspaces through multiple API scopes or delegated tokens. A compromise, prompt injection or over-permissioned connector can then expose many conversations and documents, trigger actions in connected systems, and move from one trusted channel into others.
Q: What should security teams do first when AI agents have too many integrations?
A: First, discover every agent-to-system connection and map each one to the agent, the human owner, the credential used, and the exact scopes granted. That inventory shows which integrations are unnecessary, over-privileged or duplicated, so teams can remove unused connectors, narrow OAuth scopes, rotate tokens and revoke any session that cannot be justified.
Technical breakdown
Why MCP sessions create a governance surface
MCP is a connection layer, not just an API wrapper. An agent authenticates once, then issues multiple tool calls inside a persistent session that can span data access, content generation and external actions. The security problem is that the session is governed at the protocol layer, while most enterprise controls still reason about discrete authentication events. That mismatch creates a blind spot: authorised transport does not prove authorised behaviour. What matters is the relationship between the tool call, the data exposed and the intent that justified the connection. See the MCP Security Guide.
Practical implication: Treat each MCP session as a governed access path, not a one-time login event.
Why Slack and workspace MCPs amplify intent drift
When an agent connects to collaboration or productivity systems, the blast radius is defined by the content it can read and the actions it can take, not by the fact that access was technically granted. A workspace MCP can let an agent summarise conversations, draft messages, share files or modify documents in ways that remain inside the same authenticated session. That makes scope drift hard to spot, because the access looks legitimate from the outside while the behavioural context changes underneath. Governance has to track purpose, not just permission. See the AI Agent Authorisation Guide.
Practical implication: Define channel, document and action boundaries before an agent can operate in collaboration systems.
How the long tail becomes the hardest governance problem
The long tail of MCP integrations is where shadow connections accumulate. These are the one-off tool connections built by developers, IT staff or business users that never get reviewed, documented or added to a formal inventory. Over time, that creates a distributed trust fabric in which each integration looks small, but together they form the largest unmanaged surface. The risk is not only scale. It is inconsistency, because governance expectations are applied unevenly across similar session types and the organisation loses any reliable baseline for intent enforcement.
Practical implication: Inventory and review every MCP integration, including the low-visibility connections that bypass formal security review.
Threat narrative
Attacker objective: The objective is to steer a legitimately connected AI agent into using its valid MCP session for unauthorised data access or unauthorised actions.
- Entry begins when an AI agent authenticates to an MCP server and establishes a legitimate session with persistent access to tools and data sources.
- Escalation occurs when the agent follows attacker-influenced instructions inside that session or expands into adjacent resources that were never part of its intended scope.
- Impact follows when the session is used to read, modify or act on enterprise data and systems beyond the organisational intent that originally justified access.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Persistent trust is the real MCP governance problem: these integrations turn a single authentication event into an ongoing authority relationship. That breaks the assumption that access can be evaluated at sign-in and then trusted until the next review cycle. The implication is that governance has to move from session issuance alone to session behaviour, because the risky part happens after the login event.
The least-privilege model fails when intent is not enforced at tool-call time: a connected agent can remain technically authorised while still drifting outside the purpose that justified its access. That means traditional entitlement thinking is incomplete for MCP, because permissions do not describe whether the action was appropriate for the task. The implication is a governance model built around operational intent, not static reachability.
Shadow MCP connections create a hidden identity inventory problem: the largest exposure may sit in integrations no security team formally approved, documented or can currently enumerate. That is a named governance gap, not just a hygiene issue, because unmanaged connections become durable trust paths. The implication is that discovery and review must extend to every agent-to-system relationship, not only the officially registered ones.
Tool access is becoming the new control boundary for AI agents: MCP shifts the security question from what the model can say to what the agent can do with connected systems. That changes the control plane for identity governance across NHI and autonomous workflows. The implication is that practitioners need to judge authorisation by action context, not by the mere existence of a valid connection.
MCP session governance is now a cross-domain identity issue: the same integration can expose collaboration content, structured data, operational telemetry and code paths under one trust relationship. That means IAM, PAM and NHI owners can no longer treat these surfaces separately. The implication is a unified governance model that follows the session across systems, rather than fragmenting oversight by application team.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Read next: MCP Security Guide
What this signals
Intent enforcement is becoming the practical control point for agentic access: if an agent can chain across chat, documents, telemetry and code from one authenticated session, the control cannot stop at provisioning. It has to follow the session at execution time and compare each action to declared purpose.
Governance teams should expect MCP inventories to become as important as service-account inventories once AI agents are allowed to operate across business systems. The organisations that get ahead will be the ones that can answer which integrations exist, what each one can do, and who approved that scope in the first place.
For practitioners
- Define organisational intent for each MCP connection Record which systems, data types and action classes each agent is allowed to use before the connection goes live.
- Enforce runtime checks on tool calls Evaluate each MCP action against the declared purpose of the agent before the call completes, not after an audit review.
- Inventory shadow MCP integrations Find and classify every agent-to-system connection, including developer-built and user-built integrations that never entered formal review.
- Separate data access from action authority Give different approval boundaries to read, write and share operations so a valid session cannot silently expand into higher-risk actions.
- Monitor for intent drift across connected systems Look for agents that chain from one MCP system to another in ways that exceed the original task or policy scope.
Key takeaways
- MCP creates a governance surface because one authenticated agent session can keep calling tools without fresh behavioural review.
- The largest exposure is often the least visible one: shadow integrations in the long tail of agent-to-system connections.
- Practitioners need intent-based governance, runtime evaluation and complete integration discovery to keep MCP access from outrunning control.
Related NHI Mgmt Group resources: MCP Security Guide · AI Agent Authorisation Guide · AI Agent Identity Security Buyer's Guide · AI Agent Observability, Audit and Incident Response Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | MCP sessions begin with authentication, but the article shows why that trust boundary is not enough. |
| NHI-05 — Overprivileged NHI | The post centres on agents receiving broader access than their operational intent justifies. | |
| Recommendation — Bind MCP access to strong authentication and verify each session against its intended purpose. Reduce MCP-connected agents to the minimum actions and data scopes needed for the task. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The governance failure is agent use of legitimate access beyond intended scope. |
| Recommendation — Treat unexpected tool use by agents as privilege abuse and block actions that exceed declared intent. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on authorising the right actions inside persistent agent sessions. |
| Recommendation — Review agent entitlements by action class and remove permissions that exceed business intent. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The attack pattern includes legitimate access being repurposed across connected systems. |
| Recommendation — Map agent session abuse to credential access and lateral movement behaviours in detection content. | ||
Key terms
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Organizational Intent: Organisational intent is the purpose, objective, or policy goal that a human owner wants an AI agent or automated system to pursue. It is translated into runtime instructions, permissions, guardrails, and approval rules so the system can act within a defined scope and be held to account.
- Persistent Trust: Persistent Trust is a long-lived trust relationship that lets a system, service, or agent continue operating across sessions without repeated authentication. In identity security, it usually relies on durable credentials or bindings, such as certificates, tokens, or delegated permissions, which must be tightly governed because they can outlive the original context and increase attack exposure.
- Intent Drift: A mismatch between the original purpose of an agent session and the outcome produced by a later chain of actions. It matters because each step can be individually permitted while the overall behaviour still becomes unsafe or non-compliant.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org