Topic starter
02/06/2026 6:57 pm
TL;DR: Securing MCP and AI agent access depends on OAuth-scoped tokens, backend authorization, and human approval gates rather than login alone, according to Curity’s code examples, because delegated agent paths need explicit constraint and revocation discipline. The governance problem is not authentication at the edge, but controlling what an agent can do after access is issued.
Editorial analysis by NHI Mgmt Group, based on content published by Curity: “Code Examples”.
Key questions
Q: What breaks when AI agents use authorised tools for malicious activity?
A: Single-event detection breaks first, because each call appears legitimate in isolation.
Q: Why do AI agents need approval gates before token issuance?
A: Because approval only matters if it changes the access state.
Q: How do organisations know whether agent access is actually constrained?
A: Look for evidence that every sensitive action has a distinct authorization event, a narrow token audience, and a revocation path that ends access when the task ends.
Practitioner guidance
- Define MCP server scopes explicitly Map each tool to a narrow audience and permission set so the agent can only invoke the operations it actually needs.
- Require approval before token issuance Place human approval and policy checks before the agent receives a usable token or exchanged credential.
- Separate login from authorisation decisions Do not rely on the initial user sign-in to justify later tool calls by the agent.
Bottom line: MCP and AI agent access become governable only when the credential, audience, and scope are constrained at the protocol layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 7:12 pm
MCP authorization exposes the trust boundary that most AI deployments try to avoid naming. Once an agent is allowed to call tools, the security question stops being whether the user authenticated and becomes whether the delegated identity is constrained enough to remain safe. That is a classic NHI governance problem, because the agent is operating through issued credentials rather than human judgement. Practitioners should treat MCP as an access brokerage layer, not a convenience feature.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams treat MCP access like normal user login flows?
A: No. MCP access is a delegated machine path, so the real control point is what the agent can reach after authentication. Teams should compare login assurance with post-login authorization, because the latter determines whether the agent can overreach across tools and APIs.
👉 Read our full editorial: MCP authorization and AI agent access control in Curity examples