Notifications
Clear all
Topic starter
21/08/2026 4:53 pm
TL;DR: AI agents that chain tools across Jira, Slack, warehouses, and internal systems create shadow AI when authorization stays outside the identity perimeter, according to TruFoundry’s analysis of Cross App Access and MCP gateway design. The practical shift is that access review assumptions built for static app grants break when agent-to-tool trust is mediated centrally and revoked from the IdP.
NHIMG editorial — based on content published by TruFoundry: Cross App Access on the TrueFoundry MCP Gateway
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents create more IAM risk than ordinary developer tools?
A: AI agents can make independent tool calls, chain actions, and authenticate with non-human identities while executing a task.
Q: What breaks when AI client access is governed only by per-app OAuth consent?
A: The IdP cannot see or centrally revoke the relationship between the AI client and the target tool.
Practitioner guidance
- Centralise agent-to-tool authorization in the IdP Map every AI client, MCP server, and downstream tool to a single policy layer so app-to-app trust is no longer invisible to IAM or audit teams.
- Eliminate standing credentials from agent workflows Replace shared keys and long-lived tokens with short-lived, audience-restricted assertions and keep any unavoidable secrets in a governed vault.
- Tie agent access to lifecycle events Make offboarding, role change, and group removal revoke the same grants that power user-backed AI access so access cannot outlive accountability.
What's in the full article
TruFoundry's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step XAA token exchange flow between the agent, the IdP, and the MCP Gateway.
- Gateway validation and outbound redemption logic for both XAA-native and non-native MCP servers.
- Okta group-to-team mapping and the exact identity resolution model used to scope tool access.
- Examples of request logging, guardrails, and approval workflows for high-risk write operations.
👉 Read TruFoundry's analysis of Cross App Access for MCP gateway authorization →
Cross app access for AI agents: what changes for IAM teams?
Explore further
21/08/2026 5:11 pm
Cross-app authorization is the real identity problem in enterprise AI. MCP standardises how agents talk to tools, but it does not by itself decide who is allowed to connect which client to which resource. That missing decision belongs in the identity layer, because scattered per-app grants become ungovernable as soon as agents start chaining tools across the estate. Practitioners should treat app-to-app trust as an identity governance problem, not a protocol convenience.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to the same report.
A question worth separating out:
Q: How do organisations decide whether an MCP gateway belongs in their identity architecture?
A: If they need one enforcement point for native and non-native tool servers, the gateway belongs in identity architecture. It can terminate the connection, apply tool-level policy, broker scoped assertions, and preserve a unified audit trail across the AI estate.
👉 Read our full editorial: Cross app access for AI agents shifts authorization to the IdP
