Topic starter
11/06/2026 11:35 pm
TL;DR: AI agents using the Model Context Protocol can now invoke tools, APIs, and transactions, but the article shows that coarse tokens, static rules, and implicit trust leave them exposed to prompt injection, over-broad access, and confused-deputy failures, according to Cerbos. The governance problem is no longer whether agents can act, but whether their delegated permissions stay bounded, auditable, and policy-driven.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “MCP permissions. Securing AI agent access to tools.”.
Key questions
Q: How should security teams stop AI agents from bypassing MCP controls?
A: Security teams should make the governed mediation layer the only working path to APIs and web applications.
Q: Why do coarse tokens increase risk for AI agent tool access?
A: Coarse tokens collapse many different actions into one permission set, so compromise or misuse can expose files, databases, or transactions that were never needed for the task.
Q: What breaks when authorisation is hardcoded into application logic?
A: Hardcoded access rules become brittle as systems grow, because each code path must be updated and retested whenever permissions change.
Practitioner guidance
- Define per-tool policy boundaries Map each MCP tool to a discrete allow or deny decision so read, write, and admin actions are not bundled under one credential or scope.
- Replace static role logic with runtime checks Externalise authorisation so the agent's request is evaluated at execution time against user identity, resource attributes, and action context.
- Issue short-lived delegated credentials Use scoped tokens with explicit consent and expiry so the agent cannot reuse broad access beyond the approved task window.
Bottom line: MCP changes AI agents from passive text generators into active actors, which moves access control to the centre of the design.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 8:18 am
MCP permissions are becoming the control plane for delegated AI action: once agents can invoke tools and APIs, the central question is no longer whether they can respond, but whether each action is authorised in context. Static roles and broad tokens were built for humans and coarse service flows, not for runtime decisions made by agents inside a session. Practitioners should treat policy evaluation as the point where trust is granted or denied.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What happens when an AI agent acts on a user's behalf without strict delegation controls?
A: The agent can become a confused deputy, using more authority than the user intended or sending sensitive data to an untrusted endpoint. Without explicit consent, scoped credentials, and per-action checks, the user interface may look safe while the underlying tool execution is far broader than the user can see.
👉 Read our full editorial: MCP permissions are now the control plane for AI agent access
This post was modified 5 days ago by NHI Mgmt Group