Because the model may treat descriptive text as operational guidance once the host exposes the tool and the agent calls it. That means access control is no longer only about who can install software. It is also about who can place instructions into the model’s context and what the agent is authorised to act on.
Why Plain-English MCP Instructions Become a Governance Problem
Plain-English instructions inside an MCP tool can blur the line between documentation and authority. Once an AI agent can read that text in context and act on the connected tool, the prompt becomes part of the control surface. Governance has to ask not only whether the software is approved, but whether the instruction content can steer real actions.
That matters because “instruction” is no longer just human-readable guidance. In an agentic workflow, it can influence tool selection, parameter choice, request sequencing and whether the agent treats a step as allowed. The practical governance question is whether the text can create delegated behaviour without a corresponding approval decision.
In other words, the risk is not that prose is inherently dangerous, but that prose can become operational once the agent has authority. If a host exposes a tool and the agent is authorised to use it, then plain language in the tool context can function like policy-adjacent input rather than passive description. That is why MCP needs the same scrutiny you would apply to other control inputs that shape privilege and execution.
What Changes When Context Can Influence Action
Governance gets harder when the same channel carries both explanation and instruction. A model may generalise from descriptive text, follow the nearest imperative it sees, or infer that a workflow step is expected even when the human only intended documentation. The result is ambiguous accountability: no one explicitly approved the action, but the system may still execute it.
This is especially important where tools can touch sensitive systems, because the question becomes who can shape the agent’s decision space. The direct control point is not just installation or endpoint trust, but the combination of context injection, tool exposure and the authorisation boundary around the action itself. That is why MCP authorization for HTTP transports is central to the governance conversation.
For AI agents, least privilege has to apply to the action path as well as the tool connection. If the agent can only perform tightly scoped actions, context text is less likely to become a broad delegation mechanism. But if permissions are open-ended, plain-English instructions can amplify whatever authority the agent already has.
How to Reduce the Governance Footprint of MCP Tool Text
The most effective governance model is to treat tool descriptions, prompts and operational instructions as controlled inputs, not informal documentation. Keep human-facing explanation separate from machine-actionable directives where possible, and be explicit about which fields the agent is allowed to interpret as instruction. That separation is a basic safeguard against accidental delegation.
Governance should also require per-action authorisation for higher-impact steps, especially when the tool can read, write or trigger downstream systems. NHIMG’s AI Agent Authorisation Guide is useful here because it frames task-scoped access, just-in-time approval and delegated authority as controls for agent behaviour, not just identity plumbing. The same principle applies when MCP text is part of the trigger.
Where the action boundary is unclear, add a review rule: if the tool instruction can change what the agent is authorised to do, it must be treated as a governed control, not a convenience string. That matters most for production-connected tools, because once execution is possible, language can become an access path.
Risk and Threat Considerations
Plain-English MCP instructions can become an attack surface when an adversary can influence the context, the prompt supply chain, or the tool metadata that the agent consumes. The risk is not limited to obvious prompt injection, because any instruction-like text that is trusted too broadly can nudge the agent into an unsafe or over-scoped action.
Failure mechanism: The agent interprets descriptive or instructional prose as operational guidance, then uses its existing tool authority to carry out an action that was never separately approved or bounded.
Impact: Sensitive systems can be accessed, modified or queried under an authority path that looks like ordinary tool use, which weakens auditability and can turn content handling into privilege escalation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Plain-English MCP instructions can widen agent authority or trigger unsafe actions. |
| Recommendation — Enforce per-action authorisation so tool text cannot expand agent privilege. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Agents should only act on narrowly scoped tool permissions despite contextual instructions. |
| AU-2 — Audit Events | Instruction-driven actions need logs to distinguish approved use from context-induced execution. | |
| Recommendation — Limit agent tool access to the minimum required for each task. Log agent-triggered tool actions with enough detail to reconstruct intent and authority. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Context cannot be trusted by default; each action needs verification and policy enforcement. |
| Recommendation — Verify each agent action and remove implicit trust from tool context. | ||
Practitioner Guidance
What to verify: Confirm which MCP fields are purely descriptive and which ones the agent may treat as executable guidance. If the answer is “the model can act on it,” then that text needs the same review and change control as any other governed instruction source.
Decision rule: If plain-language text can alter the agent’s choice, scope or sequence of action, require an explicit authorisation boundary before deployment. If it only explains the tool without changing behaviour, keep it outside the action path and monitor for drift.
What practitioners underestimate: The control failure is often semantic, not technical. A system can be “securely configured” and still be governed badly if its instruction text quietly expands the agent’s usable authority.
Practitioner takeaway: Treat MCP prose as potential policy input whenever an agent can execute from it; governance must bound what the text can cause, not just who can install the tool.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org