Topic starter
22/01/2026 2:53 pm
TL;DR: AI chatbots that combine LLMs, RAG, and MCP are becoming active users of enterprise systems, which means standing permissions, broad retrieval scopes, and loosely governed tool access can turn convenience into exposure, according to SGNL. Continuous authorization, not static entitlements, is the control model this category now demands.
Editorial analysis by NHI Mgmt Group, based on content published by SGNL: “Chatbots, AI, and the identity crisis we didn't see coming (or did we?)”.
Key questions
Q: How should security teams govern chatbot access when RAG and MCP are both in use?
A: They should govern access at request time, not just at login or deployment time.
Q: Why do broad chatbot permissions increase identity risk in enterprise environments?
A: Because the chatbot can become a privilege amplifier.
Q: What are the signs that chatbot authorisation is too static?
A: A common sign is that the same chatbot access works for every user and every question, regardless of data sensitivity or action type.
Practitioner guidance
- Define request-scoped authorisation Bind chatbot access to the specific requester, data source, and action so that RAG and MCP calls are evaluated in context rather than by broad default entitlement.
- Constrain retrieval scope by sensitivity Segment knowledge bases so the chatbot can only retrieve the minimum document sets needed for the function it performs, especially where confidential or regulated content is present.
- Separate human and system privileges Prevent the chatbot from inheriting more power than the human user should have, particularly where tool calls can modify records, trigger workflows, or expose executive-level information.
Bottom line: AI chatbots that combine RAG and MCP create an access governance problem because they can retrieve data and invoke tools in ways that static entitlements do not model well.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:05 pm
Continuous authorisation is now the correct control plane for AI chatbots. When chatbots combine RAG and MCP, they stop being simple interfaces and start acting as access intermediaries. That breaks the assumption that authentication at the front door is enough. The important control question becomes whether the current request is still authorised after the model selects a source or tool.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams prioritise continuous authorisation or access reviews for AI chatbots?
A: Continuous authorisation should come first because it controls access at the moment of use. Access reviews still matter, but they cannot fix a design that already grants broad standing access across RAG sources and MCP-connected tools.
👉 Read our full editorial: AI chatbot identity crisis: why RAG and MCP need tighter controls