Runtime MCP security for insurance AI workflows and compliance

At a glance

What this is: This is an analysis of how MCP servers extend AI agents into insurance workflows and why runtime controls are needed to govern data access, payouts, and compliance.

Why it matters: It matters because insurance teams are connecting agentic systems to sensitive policy, claims, and regulatory data without governance models that can keep up with dynamic execution paths.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
• 53% of MCP servers expose credentials through hard-coded values in configuration files.

👉 Read LEVO's analysis of MCP security for insurance AI workflows

Context

MCP servers are the control layer that lets AI agents reach policy systems, claims platforms, actuarial data, and fraud databases through tool calls instead of custom code. In insurance, that creates a new governance problem for non-human identity because the actor making decisions is not a person and the access path is not static.

The issue is not whether automation can reduce cycle time. The issue is whether insurers can prove, at runtime, what data an agent touched, what action it took, and whether that action stayed inside policy, jurisdictional, and financial guardrails. Without that proof, scale becomes a compliance liability rather than an efficiency gain.

This is a typical pattern for early MCP adoption: strong business value first, then security debt once the workflow reaches regulated data and payment authority.

Key questions

Q: What breaks when AI tools are exposed through loosely governed MCP servers?

A: Loose governance lets model-driven tools cross from context retrieval into state-changing actions without enough oversight. That can expose sensitive data, trigger unauthorized system changes, or widen lateral movement paths. The failure is a control boundary mismatch between what the AI can ask for and what it can safely do.

Q: Why do MCP-enabled insurance workflows create compliance risk so quickly?

A: They combine regulated data, operational action, and delegated authority in one execution chain. That means privacy, audit, and financial controls must work during the session, not after it. If the agent can see sensitive claims data and act on it immediately, the regulatory exposure is immediate too.

Q: How do you know if MCP security controls are actually working?

A: You know MCP controls are working when untrusted endpoints are blocked, privileged tool calls are minimal, and audit logs show only approved commands and data flows. If teams cannot reconstruct which server asked for what, or if secrets appear in configuration files, the control set is not operating as intended.

Q: Should insurers treat AI agent governance as part of IAM or as a separate control domain?

A: Treat it as an extension of identity governance, but with runtime enforcement added. IAM still matters for authentication, attribution, and lifecycle control, yet MCP workflows require inline policy, action-level scoping, and auditability that conventional identity reviews do not provide on their own.

Technical breakdown

How MCP servers translate natural language into governed tool calls

The Model Context Protocol exposes tools and data sources to an AI agent in a structured way, so the agent can request actions such as fetching policy details or checking fraud indicators. In practice, the risk is not the protocol alone. It is the chain of delegated authority that lets a model move from text generation to operational effect. In insurance, that can mean one instruction cascading into record access, claim validation, and payout logic across multiple systems. The security question is whether each tool call is independently scoped and logged, not whether the workflow is automated.

Practical implication: insurers need per-tool policy enforcement and traceable session logs, not only network or application perimeter controls.

Why legacy IAM and DLP miss MCP runtime risk

Legacy IAM assumes a stable subject, predictable sessions, and clear assignment of privilege to a human or service account. MCP-enabled agents break that assumption because access can be assembled dynamically during a task. DLP has a similar blind spot because it often protects storage and transmission boundaries, not the content that passes through agent prompts, tool outputs, and chained responses. In regulated workflows, that leaves claims data, medical data, and financial data exposed during the very moment when decisions are being made.

Practical implication: treat agent-to-tool execution as a new control surface that requires runtime monitoring and content-aware enforcement.

Inline policy enforcement for underwriting, claims, and fraud flows

Inline enforcement means the control plane evaluates each action as it happens, rather than checking a workflow only after the fact. That matters when an AI agent can approve a claim, request a payout, or query sensitive records in a few seconds. Runtime controls can scope permissions, redact sensitive fields, and stop a session when behavior drifts from the approved purpose. For insurance, this is the difference between automation that accelerates a controlled process and automation that silently executes an unauthorized one.

Practical implication: build blocking rules for high-risk actions such as payment approval, policy changes, and cross-jurisdiction data access.

Threat narrative

Attacker objective: The objective is to turn a normal insurance workflow into unauthorized financial, data, or compliance impact without triggering conventional perimeter defenses.

1. Entry occurs when an AI agent receives a legitimate insurance task and uses MCP to reach policy, claims, or actuarial systems through approved tools.
2. Escalation occurs when the agent's delegated access is broader than the task requires, allowing sensitive data retrieval, unauthorized approvals, or policy changes.
3. Impact occurs when the agent causes fraudulent payouts, exposes policyholder information, or creates audit failures that regulators cannot reconstruct.

Breaches seen in the wild

• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime control, not static identity policy, is the governing model for MCP-driven insurance automation. Insurance workflows now depend on AI agents that can select tools mid-session and execute actions across claims, underwriting, and fraud systems. That makes traditional pre-authorised identity assumptions too slow and too coarse for the decision path being used. The practitioner conclusion is that governance must happen where the action occurs, not after the workflow completes.

Least privilege becomes a runtime property when an agent can move from data access to financial action in one chain. The insurance use case shows why provisioning-time privilege design is incomplete when an agent can fetch records, validate evidence, and trigger a payout from the same session. The named concept here is identity blast radius: the amount of financial and regulatory damage one delegated workflow can cause before anyone intervenes. Practitioners need to measure that blast radius explicitly.

The access review model was built for durable entitlements, not ephemeral agent instructions. Review cadences assume there is a stable entitlement to inspect, certify, or revoke. In MCP workflows, a single task can create and consume privilege inside a short execution window, which means the review artifact arrives after the risk has already materialised. The implication is that certification alone cannot be the control plane for autonomous workflow access.

Insurance adds a compliance burden that makes auditability part of the control, not just the record. HIPAA, GDPR, and insurance-specific obligations require insurers to show who touched what data and why. When an AI agent is the actor, the evidence chain must be strong enough to survive legal and regulatory scrutiny. That makes immutable logging and action attribution core governance requirements, not optional observability features.

Agentic workflow security and NHI governance are converging around the same runtime problem. MCP servers sit at the intersection of workload identity, delegated access, and autonomous action. That means insurance teams cannot separate AI governance from machine identity governance when the same session handles policy data, customer data, and payment authority. The practitioner conclusion is to design one governance model that can see both the identity and the action.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• A second finding from that report shows that 80% of organisations report AI agents acting beyond intended scope, including unauthorised system access and sensitive data sharing.
• For a broader agentic-AI control baseline, see OWASP Agentic Applications Top 10 and map the insurance workflow controls accordingly.

What this signals

Identity blast radius: insurance teams should start measuring how far one MCP session can travel across records, approvals, and payment authority before a human can intervene. That metric is more useful than generic automation adoption because it captures the real governance exposure in regulated workflows.

With 53% of MCP servers exposing credentials through hard-coded values in configuration files, runtime monitoring alone is not enough. Teams need secret hygiene, tool scoping, and session controls together, or the same workflow that improves claims speed will also widen the attack surface.

The broader signal is that agentic AI in regulated operations will force IAM and NHI programmes to converge on action-level control, not just identity-level trust. For a practical framework lens, pair the insurance workflow design with NIST Cybersecurity Framework 2.0 and the NIST AI Risk Management Framework.

For practitioners

• Define per-tool authorization boundaries Map each MCP tool to a specific insurance action such as policy lookup, claims validation, or payment initiation, then deny any cross-purpose use unless explicitly approved.
• Enforce runtime blocking on financial actions Place inline policy checks before claim approval, payout execution, policy modification, and cross-jurisdiction data transfer so the session can be stopped before the action completes.
• Instrument immutable audit trails for every agent session Capture the agent identity, tool invoked, data returned, and downstream action so compliance and investigation teams can reconstruct the entire path without manual correlation.
• Segment regulated data from task execution paths Separate medical, financial, and policyholder data access from general agent workflows so an assistant cannot widen its scope simply because one task requires sensitive context.

Key takeaways

• MCP turns insurance automation into a governed identity problem because the agent can now reach sensitive systems and execute business actions directly.
• The risk is not theoretical: unauthorized payouts, data exposure, and audit failure can all emerge from a single poorly scoped agent session.
• Runtime enforcement, per-tool scoping, and immutable audit trails are the controls that matter when AI agents operate inside regulated insurance workflows.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.
• Agent-to-tool access: The permission path that lets an AI agent call a real system, query data, or trigger an operation. Unlike ordinary application access, this path can span multiple tools in one session, so the effective privilege of the server matters as much as the agent's intent.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

LEVO's full article covers the operational detail this post intentionally leaves for the source:

• Workflow examples showing how MCP connects underwriting, claims, fraud detection, customer service, and regulatory reporting.
• Runtime security capabilities such as visibility, data redaction, scoped permissions, and inline enforcement in insurance flows.
• Implementation context for privacy-first processing, kernel-level observability, and audit readiness across regulated data paths.

👉 LEVO's full article covers runtime security controls, audit readiness, and insurance-specific workflow examples.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.