Topic starter
09/07/2026 3:29 pm
TL;DR: MCP 2.0 adds OAuth, structured schemas, and elicitation flows to govern how AI agents connect to enterprise tools and data, according to Commvault’s STRIVE discussion with Werner Nel. The protocol improves authorization discipline, but blast radius, reversibility, and runtime trust still determine whether agents become controlled operators or enterprise liabilities.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “MCP 2.0 Explained: Securing AI Agents Before They Secure Themselves”.
Key questions
Q: What breaks when AI agents are given broad enterprise access without tight governance?
A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene.
Q: Why do AI agent tools need stronger controls than normal application APIs?
A: AI agent tools need stronger controls because the caller can be partially autonomous, non-deterministic, and easier to manipulate through prompts.
Q: What are the signs that an MCP implementation is not governed well enough for production use?
A: Common warning signs include broad tool access, missing masking on sensitive outputs, no approval path for privileged writes, and little or no tracing from agent to API.
Practitioner guidance
- Define agent authority before deployment Map each AI agent to the exact enterprise resources, tools, and operations it may use, then remove any permissions not required for the task.
- Use structured tool schemas for every sensitive action Require explicit schemas for commands that modify systems, move data, or trigger downstream workflows.
- Insert pause points for irreversible workflows Route high-risk actions through elicitation flows or equivalent approval steps before the agent can commit changes to systems of record.
Bottom line: MCP 2.0 reframes AI agent governance around authority, pause points, and action scoping rather than simple tool connectivity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:49 pm
AI agents are now non-human identities, not just application features. Once an agent can read, modify, or decide, the identity question becomes central: what can it do, under what authority, and with what rollback boundary? That makes MCP governance an IAM and PAM problem as much as an AI problem. Practitioners should stop treating agent control as a protocol detail and treat it as a runtime identity model.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams respond when AI agents can make irreversible changes?
A: They should require explicit confirmation, constrain the tool surface, and design for rollback before the agent is allowed to commit the action. Where rollback is not practical, the workflow should force additional validation or human review so the action cannot silently propagate through downstream systems.
👉 Read our full editorial: MCP 2.0 shifts AI agent governance from connectivity to control