Topic starter
25/06/2026 12:02 am
TL;DR: Omada’s MCP Developer Reference shows how AI systems can interact with governed identity data through auditable channels, positioning MCP as the integration layer while IGA remains the policy and oversight layer, according to Omada Identity. The governance question is no longer whether AI can connect to identity systems, but whether access, accountability, and policy enforcement stay intact when intelligent systems become part of the control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Omada Advances AI-Ready Governance with the Model Context Protocol Initiative”.
Key questions
Q: How should security teams govern managed MCP access for AI clients?
A: Security teams should treat managed MCP as a federated resource server and issue identity-bound tokens for each delegated task.
Q: Why do standard protocols create governance risk when AI systems use them?
A: Standard protocols reduce integration friction, which makes it easier for AI systems to reach identity data quickly and at scale.
Q: What breaks when AI-assisted IGA is treated as the same thing as IGA for AI?
A: The programme loses a critical distinction between using AI to improve governance work and governing the AI system itself.
Practitioner guidance
- Define MCP as a governed access path Classify every MCP connection to identity data as part of the control boundary, with explicit policy, logging, and approval ownership.
- Separate AI assistance from AI supervision Document which workflows use AI to assist IGA and which workflows require governance over AI behaviour itself, then assign different controls to each.
- Validate request-time authorisation Check that access decisions are evaluated at the moment of each AI request, not just when the integration is onboarded or the connector is approved.
Bottom line: MCP can make AI access to identity data more consistent, but consistency is not the same as governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:49 am
MCP is becoming the governance boundary, not just the integration layer: once AI systems use standard protocols to reach identity data, the control question shifts from connection design to authority design. Identity teams have to decide whether the protocol is simply moving data or also moving decision power. The practitioner implication is that MCP belongs inside the governance model, not outside it.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams review before connecting AI agents to identity systems?
A: Teams should review the data scope, request authority, audit trail, and accountability model before enabling AI agents to interact with identity systems. The key question is whether the agent can only retrieve information or whether it can also influence decisions and workflows. If that line is unclear, the control model is incomplete.
👉 Read our full editorial: MCP for identity governance: what AI-ready governance changes