Runtime MCP security for public sector AI agents and citizen data

At a glance

What this is: This is an analysis of how MCP servers let public sector AI agents reach operational systems, and why runtime security is needed to reduce data, compliance, and privilege risk.

Why it matters: It matters because identity teams supporting government AI must govern non-human access in real time, not just audit it after the fact, or citizen data and service integrity can be put at risk.

By the numbers:

• Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
• 53% of MCP servers expose credentials through hard-coded values in configuration files.

👉 Read LEVO's analysis of runtime MCP security for public sector AI agents

Context

Model Context Protocol servers are emerging as the control point between AI agents and the systems they need to use. In public sector environments, that means the identity problem is no longer limited to human employees and contractors. It now includes non-human identities that can query, combine, and act across sensitive systems in real time.

The governance gap is that most public sector controls were built for static roles, periodic review, and perimeter-based oversight. MCP-driven workflows behave differently because tool use happens during execution, across internal systems, and often with authority that is broader than the original task description.

For public agencies, that creates a direct link between identity governance and service trust. If the access path is not scoped, observable, and revocable at runtime, AI-assisted service delivery can become a channel for data exposure, compliance failure, or unauthorized action.

Key questions

Q: What breaks when MCP-connected AI agents do not have scoped identities?

A: The control boundary breaks first. Without a distinct identity, scoped permissions, and per-call authorization, the agent becomes a generic access path that cannot be reliably audited or contained. That means the organisation loses the ability to prove who or what performed a tool action, which is exactly the kind of ambiguity identity governance is meant to remove.

Q: Why do MCP workflows create compliance risk for public agencies?

A: They create compliance risk because the relevant control point is runtime action, not just login or role assignment. If an agent can move citizen or operational data across systems without inline policy checks, the agency may be unable to prove lawful access, retention limits, or purpose limitation.

Q: How do security teams know whether MCP server governance is working?

A: They should be able to answer four questions at any time: what servers exist, which are official, what credentials they can use, and what systems they contact. If those answers are unclear, governance is not working. The signal is not just fewer alerts, but clear attribution and scoped access across the fleet.

Q: What should public sector teams do first before scaling MCP for AI?

A: Start by inventorying every MCP-connected system, then assign each tool a narrow purpose and an accountable owner. From there, require inline enforcement and immutable logs so every agent action can be limited, traced, and reviewed without relying on periodic audits alone.

Technical breakdown

How MCP servers turn AI agents into active system actors

MCP servers expose enterprise systems as tools that an AI agent can call during a session. The protocol standardises how agents request context and invoke actions, which makes integration easier but also shifts risk from perimeter access to runtime authorisation. In practice, the server becomes a switchboard between the agent and internal systems such as records, billing, scheduling, and case-management platforms. If permissions are broad or poorly segmented, the agent can combine data sources in ways that were never intended at provisioning time.

Practical implication: treat each MCP tool as a governed access path, not a convenience layer.

Why legacy IAM does not fully govern MCP workflows

Traditional IAM is strong at establishing who can sign in and which role a person or service account should have. MCP changes the problem because the important decision point is not just authentication, but what the agent can do after it is already inside the workflow. That is a runtime authorisation issue. Periodic access reviews, network firewalls, and file-centric DLP controls do not reliably see east-west calls between agents, MCP servers, and backend systems, so they miss the actual action path.

Practical implication: move from identity at login to identity at action, with controls that inspect each tool call.

What runtime enforcement adds to public sector AI governance

Runtime MCP security combines tracing, redaction, scoped permissions, and inline blocking so agencies can control data use while the workflow is running. That matters because public sector AI often touches regulated information such as citizen identifiers, benefits records, and operational data. Immutable logs also create continuous evidence for accountability and audit. The key design shift is that security becomes part of the transaction rather than a separate review layer after the fact.

Practical implication: require inline policy enforcement wherever AI agents can reach sensitive public systems.

Threat narrative

Attacker objective: The objective is to misuse agent permissions to extract sensitive data or alter public sector workflows without immediate detection.

1. Entry occurs when an AI agent is granted MCP access to public sector systems for tasks such as permits, scheduling, billing, or citizen service lookup.
2. Escalation follows when the agent is given broader tool permissions than the task requires, allowing it to combine sensitive data or invoke actions across multiple backend systems.
3. Impact occurs when those excessive permissions expose citizen data, trigger compliance breaches, or enable unauthorized operational changes that undermine public trust.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime MCP security is becoming the control plane for public sector AI governance. Public agencies are not simply adding another integration layer when they adopt MCP. They are creating a new decision point where non-human identities can move from data retrieval to action execution inside sensitive services. That changes the centre of gravity for identity governance, because the key question is no longer who can log in, but what an agent can do after tool access is granted. The practitioner conclusion is straightforward: MCP must be governed as a live access pathway, not a static connector.

Public sector IAM assumptions break when agent actions are not observable at the right boundary. IAM was designed for roles, sessions, and reviewable entitlements. That assumption fails when a workflow can query, correlate, and act across multiple systems in a single runtime path. The implication is not simply more logging. It is that governance models built around periodic certification are too slow to explain or constrain what the agent actually did. Practitioners need to recognise that action-level visibility is now part of identity control.

Scoped tool permissions are the difference between service acceleration and permission sprawl. The article’s central security problem is not that AI agents exist, but that they can be connected to systems with far more authority than the task requires. That is a classic non-human identity pattern, now expressed through MCP. When tool scoping is weak, agencies inherit blast-radius problems across citizen data, workflows, and compliance obligations. The practitioner conclusion is to map every MCP tool to an explicit business purpose and a bounded access set.

Continuous evidence changes public accountability from retrospective to operational. Public sector environments need to explain not only what was accessed, but why it was accessed and whether the access was justified. Immutable logs and inline enforcement make that possible in a way periodic audits cannot. The broader identity lesson is that governance for non-human actors must produce evidence as part of execution, not as an afterthought. Practitioners should treat auditability as a runtime requirement, not a reporting feature.

Runtime MCP visibility sharpens the identity blast radius concept for AI-enabled services. Once an AI agent can orchestrate across planning, compliance, transportation, and citizen services, the blast radius is no longer tied to one system. It is tied to the span of tool permissions and the quality of runtime controls. That is why public sector AI programmes need an identity model that follows the action path across systems. The practitioner conclusion is to govern by path and privilege scope, not by application silo.

From our research:

• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
• Our research also shows that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which is why repeated exposure cannot be treated as an isolated event.
• For a broader control perspective, see 52 NHI Breaches Analysis, which connects repeat compromise patterns to governance failures across service and machine identities.

What this signals

Runtime MCP controls will become a baseline expectation for public sector AI programmes. Agencies that keep treating agent access as a one-time integration decision will struggle to prove they can contain data movement once workflows start spanning multiple systems. The governance shift is toward action-level controls, not just identity issuance, and that aligns closely with the control logic in the OWASP Top 10 for Agentic Applications 2026.

Identity blast radius will matter more than total agent count. The operational question is not how many AI workflows exist, but how far each one can reach if permissions are mis-scoped. In our view, that makes scoped MCP design and continuous traceability the two programme-level signals most likely to separate controlled adoption from unmanaged expansion.

With more than 1 in 5 non-human identities believed to be insufficiently secured in the average organisation, governance teams should expect the same weak patterns to reappear in AI toolchains. The public sector may adopt different systems, but the underlying control failure is familiar: access grows faster than oversight. That is why the lifecycle of non-human access now needs to be managed as carefully as any human entitlement path.

For practitioners

• Map every MCP tool to a specific business purpose Document which public service outcome each tool supports, then remove any backend access that is not required for that outcome. The goal is to prevent a broad agent session from becoming a general-purpose access path.
• Enforce runtime scoping on agent permissions Apply least privilege at the tool level and verify that access can be narrowed per task, per system, and per data class. This is especially important for citizen identifiers, service records, and operational systems.
• Trace each MCP call to an accountable identity Require logs that show which agent accessed which system, what action was requested, and what data moved as a result. Without action-level attribution, agencies cannot explain or investigate automated decisions.
• Block unauthorized actions inline Use enforcement points that stop disallowed tool use before the request reaches the backend system. Post-event review is not enough when the workflow itself can create compliance exposure in real time.

Key takeaways

• MCP gives AI agents real operational reach, which turns tool access into an identity governance problem, not just an integration choice.
• The main failure mode is over-scoped non-human access, where a single agent can cross systems, expose citizen data, and create compliance evidence gaps.
• Public sector teams need runtime scoping, inline enforcement, and immutable logs before MCP-driven AI moves from pilot to production.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Inline Enforcement: Inline enforcement is the technical act of applying access policy in the live session path, not just at approval time. It matters because identity governance without runtime enforcement can authorize access that the session layer never actually constrains, especially in distributed and third-party environments.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

LEVO's full article covers the operational detail this post intentionally leaves for the source:

• How runtime MCP security traces every agent call across public sector systems without developer overhead.
• How inline redaction and policy enforcement handle citizen data, residency rules, and compliance boundaries in practice.
• How scoped permissions and immutable logs support audit readiness across local, state, and national requirements.
• How Levo's privacy-first deployment model is positioned for agency environments that want AI adoption without moving data out of place.

👉 LEVO's full article covers the public sector use cases, runtime controls, and compliance arguments in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.