Back to Home

MCP / Tool-Using Agents

Tool access is authority. Govern it explicitly.

The question is not whether an MCP server is trusted. The question is whether this actor may invoke this operation now.

Core problem

Tool invocation expands agent authority quickly. Runtime controls define allowed operations per tool and per actor context.

Typical actors

  • MCP-connected assistants
  • Internal tool-calling agents
  • Task automation copilots
Actor
→
Action
→
Decision
ALLOW continues
BLOCK terminates

Policy Violation Blocked

× BLOCK
Actor
MCP-connected assistant
Human
Enterprise operator
Process
runtime policy engine
Action
delete_database
Resource
Sensitive production resource
Policy
Autonomous actor policy boundary
Live product evidence aligned to this use case.

Allowed

  • read_customer
  • search_documents
  • create_ticket
  • query_status

Blocked

  • delete_database
  • bulk_export_secrets
  • disable_monitoring
  • unapproved admin operations

Authorize each tool operation by actor and context, so trusted tools do not become unrestricted authority.

Test the Boundary