Topic starter
26/08/2026 11:51 am
TL;DR: MCP v2 makes every request easier to inspect and authorize, but it still cannot record which person decided an agent action, according to Cakewalk’s analysis. That leaves auditability split across protocol, gateway, and identity systems, and it means governance for agentic workflows still depends on external accountability design, not the wire protocol alone.
Editorial analysis by NHI Mgmt Group, based on content published by Cakewalk: “MCP v2 Improves Agent Access Control and Still Cannot Say Who Decided”.
Key questions
Q: Where does MCP v2 fail to provide full audit accountability for agent actions?
A: It fails at the point where a human decision must be preserved as evidence.
Q: Why can MCP approvals still produce weak attribution even when access is authorised correctly?
A: Because the protocol can validate the approval event without carrying the original decision-maker through to the final audit record.
Q: What are the signs that agent logs are not enough for governance?
A: The warning sign is when logs can name the agent and the account, yet still cannot answer who requested the action, who approved it and who should own the outcome.
Practitioner guidance
- Separate authorisation from accountability design Map where each decision is made, where each request is approved and where the final audit record is written.
- Record delegation before the first tool call Bind the delegating person to the agent at onboarding or session start, then keep that linkage available to gateways, logs and incident reviewers.
- Treat approval flows as identity events Log the user who started the task, the user who completed any elicitation step and the account used for execution as separate fields in downstream systems.
Bottom line: MCP v2 improves per-request authorisation, but the protocol still leaves human accountability outside the standardised message flow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Request authorisation and audit accountability are different control problems: MCP v2 improves the former without solving the latter. The protocol can make a call easier to inspect, but inspection of a call is not the same as proving who decided it. For identity governance, that means protocol compliance cannot be mistaken for evidentiary accountability; the delegating human still has to be captured elsewhere.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do security teams prove accountability for agent actions through MCP?
A: They need structured audit records that tie each tool invocation back to the human who exercised the authority, along with the tool name, parameters, server, and policy decision. Without that chain, review teams cannot reconstruct what happened or who authorised it.
👉 Read our full editorial: MCP v2 improves agent access control but not audit accountability