Topic starter
22/08/2026 12:01 pm
TL;DR: Enterprises are connecting AI agents to Snowflake, Salesforce, APIs, and private data stores through MCP, but only 8.5% of servers use OAuth and many deployments still rely on static credentials, according to Trust3. Authentication gets an agent inside; without per-action authorization, delegation, and purpose-bound access, the control model collapses.
Editorial analysis by NHI Mgmt Group, based on content published by Trust3: “MCP Authentication Is Not Enough: Why Agentic AI Systems Need Fine-Grained Authorization.”.
By the numbers:
- Only 8.5% of MCP servers use OAuth, according to Trust3.
- 1,862 MCP servers are exposed on the public internet, according to Trust3.
- More than 30 CVEs were filed against MCP implementations in a single 60-day window, according to Trust3.
Key questions
Q: What breaks when MCP authorization is left to individual users?
A: You get fragmented trust, inconsistent policy, and no reliable enterprise audit trail.
Q: Why do autonomous agents make traditional RBAC less reliable?
A: RBAC becomes less reliable because it assumes the privilege holder will interpret context, follow policy, and remain accountable in a human decision loop.
Q: How do security teams know if agent authorization is actually working?
A: Authorization is working only if the agent can complete the intended task without gaining unnecessary reach.
Practitioner guidance
- Inventory every MCP-connected agent Map which agents, tools, data stores, and APIs are reachable through MCP, then classify each connection by business purpose and privilege scope.
- Replace standing access with task-scoped grants Move away from persistent tokens and broad roles, and issue time-bound permissions that are tied to a declared purpose and expire automatically.
- Propagate user identity through delegation chains Ensure downstream tools see the initiating user, the declared purpose, and the current authorization verdict, not just the service account identity.
Bottom line: MCP creates a governable identity surface only if authentication is paired with action-level authorization.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/08/2026 12:02 pm
Authentication-only designs create a false boundary for agentic systems: MCP proves identity, but identity proof does not equal entitlement. Once the agent is inside, the control question changes from access to action, and that is where conventional IAM assumptions begin to fail. The implication is that enterprise AI governance must treat authorization as a runtime decision, not a session property.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should organisations do when MCP endpoints rely on static credentials?
A: They should assume the exposure window is too wide and replace persistent secrets with task-scoped grants, strong audit trails, and action-level policy enforcement. Static credentials are especially dangerous when agents can reach multiple systems from one session, because compromise in one place can propagate everywhere.
👉 Read our full editorial: MCP authorization gaps expose enterprise AI agent access control failures