Notifications
Clear all
Topic starter
24/06/2026 9:05 pm
TL;DR: MCP shifts AI agents from API callers to context-aware actors, which makes identity, delegation, consent, and policy enforcement the real control surface, according to Permit.io. Access control built for scripted requests breaks down when agents can choose tools, chain actions, and change behaviour as context changes.
NHIMG editorial — based on content published by PermitIO: The Ultimate Guide to MCP Auth: Identity, Consent, and Agent Security
By the numbers:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams govern MCP access for AI agents?
A: Treat MCP access as delegated machine authority, not a normal application login.
Q: Why do MCP-based agents increase identity governance risk?
A: Because the agent can select tools and chain actions at runtime, which means authority is no longer fixed at issuance.
Q: What do security teams get wrong about OAuth in agentic systems?
A: They treat OAuth as if it fully represents delegation.
Practitioner guidance
- Assign unique identities to every agent Give each agent a distinct, traceable identity so every action can be tied back to a specific runtime actor and delegated authority.
- Separate login from delegation consent Model consent as a bounded approval that states which tools, actions, and downstream services an agent may use on behalf of a user.
- Insert a policy middleware boundary Place enforcement between the agent and the MCP server so you can evaluate tool exposure, log decisions, and block unsafe behaviour before any upstream service call is made.
What's in the full article
PermitIO's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how MCP auth, delegation, and consent are separated in practice.
- Discussion of middleware enforcement patterns for policy injection and behaviour logging.
- Implementation guidance for fine-grained permissions when agents chain tools across systems.
- The article's own examples of where client and server support remains inconsistent today.
👉 Read PermitIO's guide to MCP identity, consent, and agent security →
MCP auth for agents: what IAM teams need to control?
Explore further
25/06/2026 6:05 am
Context-aware delegation is the new identity boundary for agentic systems. MCP does not fail because it is too powerful. It fails when organisations treat the agent as a passive API caller instead of an actor whose runtime choices alter the security boundary. That pushes identity teams to govern delegation relationships, tool exposure, and revocation with the same seriousness they apply to privileged machine accounts.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding from our research shows that only 5.7% of organisations have full visibility into their service accounts, which is why delegated access paths are still so hard to govern.
A question worth separating out:
Q: Who should be accountable when an MCP agent misuses delegated access?
A: Accountability should sit with the identity and governance chain that authorised the delegation, not with an abstract model or shared token. The organisation must be able to show who granted scope, what the agent could reach, and where revocation was enforced.
👉 Read our full editorial: MCP identity and consent controls for agentic systems
