Topic starter
03/06/2026 2:23 pm
TL;DR: AI agents can chain read, write, delete, and send actions through MCP servers in seconds, often outside the governance, approval, and audit layers security teams use for people, according to Entro Security. Existing IAM assumes visible, reviewable sessions, but agent actions can complete before any control sees them.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Your AI agents are taking actions you never approved. Here’s how to stop it.”.
Key questions
Q: What breaks when AI agents can chain tools through MCP without tight policy controls?
A: What breaks is the separation between request, authorisation, and execution.
Q: Why do MCP-connected AI workflows create new governance risk?
A: MCP-connected workflows expand the identity perimeter because a model can act through tools and data sources rather than only through a human user session.
Q: How do security teams know whether MCP server governance is working?
A: They should be able to answer four questions at any time: what servers exist, which are official, what credentials they can use, and what systems they contact.
Practitioner guidance
- Map MCP action paths Inventory which agents can reach which MCP servers, then enumerate the exact read, write, delete, and send actions each connection allows.
- Enforce action-level policy Create deny and allow rules around agent, target, and action type so high-risk operations are blocked before execution, not after review.
- Separate observation from enforcement Keep logs and session traces, but do not rely on them as the control point for agentic operations that can finish in seconds.
Bottom line: MCP servers turn AI agents into runtime actors that can change systems directly, so governance has to move closer to execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 2:31 pm
MCP governance is an execution problem, not a monitoring problem. The article shows that agent actions through MCP servers happen below the layers most IAM programmes were built to observe. That means the relevant control question is not whether the session is visible, but whether the action itself can be authorised before it executes. Practitioners should treat the MCP layer as a policy boundary, not a telemetry source.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when agents need access to Slack, Jira, and databases through MCP?
A: Apply separate policies for each target and action type instead of granting broad session-level access. If the same agent can read, write, and delete across collaboration tools and production data stores, the governance boundary is too coarse to prevent compound risk.
👉 Read our full editorial: MCP server actions create a new governance blind spot for AI agents