Why do MCP tunnels still require IAM and NHI controls?

Why This Matters for Security Teams

MCP tunnels often create a false sense of completion: the transport is secured, so the problem is assumed to be solved. It is not. A tunnel only moves requests; it does not decide whether an AI agent should be allowed to invoke a payment API, query customer records, or reach a production admin tool. That decision still belongs to IAM, NHI lifecycle controls, and policy enforcement at the identity layer.

This distinction matters because non-human access fails differently from human access. Service accounts, API keys, and agent credentials are frequently over-privileged, long-lived, and poorly revoked, which is why NHIMG research shows that 88.5% of organisations say their NHI practices lag behind or merely match their human IAM programs. A secure tunnel cannot compensate for weak ownership, missing offboarding, or secrets that remain valid after a compromise.

For security teams, the practical risk is simple: if the tunnel is treated as the control, authorization gets deferred to whatever the agent can reach once connected. That is exactly how over-permissioned access slips into sensitive systems and stays there unnoticed. In practice, many security teams encounter NHI abuse only after a tunnel has already carried privileged access into production, rather than through intentional identity governance.

How It Works in Practice

The right model is layered. MCP transport should be treated as a connectivity channel, while IAM and NHI controls govern what the agent may do once the channel exists. At runtime, the system needs to bind an agent’s workload identity to a specific task, evaluate policy in context, issue short-lived credentials, and revoke them when the task ends. That is the operational difference between a tunnel and a trust decision.

In mature setups, the agent presents workload identity through cryptographic proof, such as OIDC-based assertions or SPIFFE/SPIRE-style identities, and the authorization layer evaluates intent before granting access. That aligns with current guidance from OWASP Top 10 for Agentic Applications 2026 and NIST SP 800-53 Rev. 5, both of which emphasise least privilege, accountability, and continuous control enforcement. The practical sequence is usually:

• Authenticate the agent as a workload, not as a shared secret.
• Authorise the requested action at request time, using context such as tool, dataset, environment, and task.
• Issue just-in-time, ephemeral credentials with a tight TTL.
• Log every tool call and entitlement decision for audit and incident response.
• Revoke access automatically when the task completes or the policy changes.

This is why the 2024 Non-Human Identity Security Report is so relevant: organisations continue to report weak confidence in their ability to manage workload identities, which is exactly the gap MCP tunnels do not close. These controls tend to break down when agents are allowed to chain tools across hybrid environments because static entitlements cannot keep pace with runtime behaviour.

Common Variations and Edge Cases

Tighter identity controls often increase operational overhead, requiring organisations to balance faster agent productivity against stricter authorization, rotation, and audit requirements. There is no universal standard for this yet, especially in multi-agent workflows where one agent delegates to another or hands off tool access mid-task.

That is why guidance is evolving around intent-based authorization and policy-as-code. In some environments, a single MCP gateway can enforce coarse routing, but finer decisions still need to happen in the identity plane. In others, the tunnel terminates inside a service mesh or zero trust boundary, yet NHI controls remain mandatory because the agent may still reach downstream APIs, data stores, or internal orchestration tools through chained calls.

Edge cases matter most when credentials are cached, shared across agents, or embedded in CI/CD and runtime configs. NHIMG’s Top 10 NHI Issues research highlights why static secrets, missing rotation, and poor offboarding keep showing up in real incidents. The same pattern appears in agentic systems: if access is durable, the tunnel merely preserves the blast radius. Where agents operate across regulated data, production tools, or delegated third-party workflows, current guidance suggests treating every tool call as a new authorization event rather than assuming prior tunnel approval still applies.

Related resources from NHI Mgmt Group

• How do IAM teams evaluate MCP architectures without locking into one vendor?
• Why do secrets create disproportionate risk in NHI environments?
• What is the difference between human IAM controls and NHI governance?
• How should teams reduce the risk from exposed NHI secrets?