Source: Cloud Security Alliance
Author: unknown
URL: https://cloudsecurityalliance.org/blog/2026/10/20/mcp-tool-exposure-is-a-privilege-grant-a-two-gate-authorization-model-for-agentic-ai
ONE SENTENCE SUMMARY:
MCP tool catalogs expand agent privilege surfaces, requiring separate capability admission and resource-aware execution authorization enforced outside models.
MAIN POINTS:
- MCP enables agents to operate across repositories, databases, tickets, messaging, and workflows.
- Tool visibility implies operational capability consideration, expanding the agent’s privilege surface.
- Capabilities like searchDocuments differ drastically from deleteEnvironment in authority and risk.
- Gate 1 decides whether a capability should be exposed to an agent at all.
- Gate 2 decides whether a specific invocation is authorized for a resource now.
- Least capability should precede least privilege, avoiding generic primitives for probabilistic agents.
- Narrow tools preserve security boundaries by keeping sensitive logic in deterministic code.
- tools/list filtering reduces exposure but must not function as an authorization boundary.
- Tool calls should be treated as intent requests needing external policy enforcement.
- Authorization must incorporate actor, delegation chain, action, resource, and transaction risk context.
TAKEAWAYS:
- Treat new agent-callable tools as privilege changes requiring governance and review.
- Prefer constrained operations over execute-anything primitives to limit misuse blast radius.
- Separate discovery minimization from invocation enforcement to prevent bypass via direct calls.
- Bind authorization decisions to both tool and target resource, not tool name alone.
- Keep final allow/deny decisions in trusted controls, never inside the model’s reasoning layer.