Notifications
Clear all
Topic starter
22/08/2026 12:01 pm
TL;DR: Enterprises are connecting AI agents to Snowflake, Salesforce, APIs, and private data stores through MCP, but only 8.5% of servers use OAuth and many deployments still rely on static credentials, according to Trust3. Authentication gets an agent inside; without per-action authorization, delegation, and purpose-bound access, the control model collapses.
NHIMG editorial — based on content published by Trust3: MCP Authentication Is Not Enough: Why Agentic AI Systems Need Fine-Grained Authorization
By the numbers:
- Only 8.5% of MCP servers in the wild use OAuth.
- 1,862 MCP servers were exposed directly on the public internet.
- More than 30 CVEs were filed against MCP implementations in a single 60-day window in early 2026.
Questions worth separating out
Q: What breaks when MCP servers do not require authentication?
A: When MCP servers do not require authentication, the access boundary disappears.
Q: Why do RBAC policies often fail for AI agent governance?
A: RBAC fails when the real decision depends on delegation, tenant scope, sub-agent propagation, or changing runtime conditions.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Enforce per-action authorization Move authorization checks from session start to each tool call, data request, and downstream action so the agent is evaluated at the moment of use, not just at login.
- Bind access to declared purpose Require agents to present a declared purpose that is evaluated alongside identity and entitlements, then scope access to the specific task rather than a broad role.
- Preserve identity through delegation chains Carry the original user identity, purpose, and entitlement context through every agent hop so downstream systems can make a real authorisation decision instead of trusting the service account alone.
What's in the full article
Trust3's full blog covers the operational detail this post intentionally leaves for the source:
- Detailed explanation of the Unified Trust Layer architecture and how it evaluates policy before each tool call.
- Step-by-step breakdown of purpose-based access control across delegation chains and multi-agent workflows.
- Framework mapping for OWASP ASI and NIST AI RMF, including the control questions used in practice.
- Examples of how the platform handles audit traces, drift detection, and protocol-layer enforcement.
👉 Read Trust3's analysis of MCP authentication gaps and fine-grained authorization →
MCP authorization gaps: are your AI agent controls keeping up?
Explore further
22/08/2026 12:02 pm
Authentication without authorization is the wrong security boundary for AI agents: MCP confirms identity, but identity alone does not govern runtime action. In agentic systems, the decisive question is not who connected, but what that identity is allowed to do right now, for this purpose, through this delegation chain. That is why MCP authorization is an identity governance problem, not a protocol footnote. Practitioners should treat post-authentication decisioning as the real control plane.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 33% of organisations report their AI agents have accessed inappropriate or sensitive data beyond their intended scope, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who is accountable when a compromised AI agent misuses delegated access?
A: Accountability usually spans the business owner of the workflow, the team that issued or approved the credential, and the vendor if a third-party integration was involved. The critical governance question is not who logged in, but who allowed the delegation chain to exist and remain valid. That chain must be documented before incidents occur.
👉 Read our full editorial: MCP authorization gaps expose enterprise AI agent access control failures
