Why do MCP servers need identity controls if telemetry already shows every request?

Why telemetry alone cannot decide trust in MCP

Telemetry is retrospective: it shows what was requested, from where, and often how often, but it does not by itself prove that the caller was the right principal to act. In MCP, that gap matters because a server can observe a perfectly normal call pattern while still serving an unsafe or over-broad session.

Identity controls answer the earlier question, who is allowed to use this server, under which delegated authority, and with what boundaries. That decision is what prevents a valid-looking request from becoming an inappropriate one.

What delegated MCP sessions change about the trust model

Delegated sessions are the key reason identity must sit in front of telemetry. The same sequence of tool calls can be acceptable when initiated by a tightly scoped session and unsafe when initiated by a reused credential, a stale token, or a confused deputy path that inherits more authority than intended.

The practical issue is not whether the request was observable, it is whether the session context still matches the permissions, user intent, and resource boundary that should govern the call. The MCP authorization specification is explicit that servers should treat authorization as first-class, which is why telemetry is a control complement, not a substitute.

How to use telemetry and identity together without confusing their roles

Telemetry is strongest after the fact: it supports audit, anomaly detection, forensics, and detection of misuse patterns. Identity controls are strongest at decision time: they validate the caller, constrain the session, and limit what any given token, user, or agent can do before the request is executed.

For MCP servers, that means designing the trust boundary around authentication, authorization, audience-bound tokens, and least privilege, then using telemetry to verify whether those controls behaved as expected. MCP Security Guide and RFC 9728: OAuth 2.0 Protected Resource Metadata both support that separation by grounding MCP in explicit authorization discovery rather than blind request acceptance.

Risk and Threat Considerations

Telemetry can show that a request happened, but it cannot stop token replay, credential theft, delegated misuse, or a compromised agent from making a seemingly ordinary call. If teams rely on logs alone, they often discover that the server was behaving exactly as designed while the trust decision was made too late.

Failure mechanism: A caller obtains a valid session or token and then exercises permissions that were not tightly scoped to the original user intent, while telemetry simply records the resulting activity after execution.

Impact: The server may disclose data, invoke tools, or mutate state under an apparently normal request trail, which makes the abuse harder to prevent and only partially easier to reconstruct.

Practitioner Guidance

What to prioritise: Put identity and authorization checks on the request path, then use telemetry to confirm those checks are behaving as intended. If the server can take an action with business impact, it should not be relying on observability alone to decide whether the action is allowed.

What to verify: Confirm that each session has a clear principal, a bounded audience, and permissions narrow enough that a logged request can be judged against a meaningful trust decision. If the same session can be reused across users, agents, or environments, treat that as a control gap rather than a logging strength.

Practitioner takeaway: Telemetry tells you what happened, but identity controls determine whether it should have been possible in the first place.

Related resources from NHI Mgmt Group

• Why is OAuth considered a better alternative for MCP servers?
• Why does host telemetry matter when identity controls already exist?
• What breaks when MCP servers are exposed without identity controls?
• How should security teams combine content inspection with identity controls for AI agent access to MCP servers?