Topic starter
24/06/2026 8:40 pm
TL;DR: MCP makes AI agents active tool users, so static API keys, long-lived tokens, and coarse permissions become blast-radius risks once agents query databases, update systems, and call SaaS APIs on behalf of users, according to PermitIO. Authorization must move from fixed grants to runtime, context-aware decisions that match delegated intent and relationships.
Editorial analysis by NHI Mgmt Group, based on content published by PermitIO: “Authorization Strategies for Model Context Protocol (MCP)”.
Key questions
Q: What breaks when MCP agents are given broad permissions?
A: Broad permissions turn one compromised or manipulated agent into a wide-blast-radius identity.
Q: Why is OAuth 2.1 not enough for MCP authorization?
A: OAuth 2.1 solves delegation mechanics, but it does not decide the real permissions an agent should have.
Q: What is the difference between RBAC, ABAC, and ReBAC for RAG authorization?
A: RBAC assigns access through roles, ABAC through attributes and policies, and ReBAC through explicit relationships between users and resources.
Practitioner guidance
- Define task-scoped agent permissions Map each MCP tool to the narrowest action set the agent actually needs, then separate read, write, and administrative capability so one token cannot span all three.
- Replace standing access with runtime policy checks Enforce decisions at request time so access expires when the user context, tool choice, or session purpose changes.
- Model delegation chains explicitly Represent who the agent acts for, which resource it may touch, and which relationships justify the action before any tool call is allowed.
Bottom line: MCP turns agent access into a live authorization problem because tool use now happens inside production workflows, not in a separate sandbox.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:23 am
Runtime authorisation is the real control plane for MCP. MCP does not merely connect agents to tools, it turns delegation into an active production permission problem. Static grants cannot keep pace with an actor that discovers tools, adapts behaviour, and executes on behalf of different users. The implication is that identity governance must move from provisioning-time logic to decision-time enforcement.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern zero standing permissions for AI agents?
A: Teams should treat zero standing permissions as the default operating model for agentic access. The agent should receive only the permissions needed for the current task, and those permissions should disappear when the task ends or the context changes. This reduces blast radius and prevents ambient authority from accumulating over time.
👉 Read our full editorial: Mcp authorization strategies for autonomous agents need runtime control