MCP Is a Boundary, Not a Constraint Layer

MCP can standardize how an AI application discovers and calls tools, reads resources, and obtains prompts. It is useful for interoperability. It does not become a system constitution, a complete governance layer, or an RBAC replacement merely because a tool has a schema.

Control Protocol may help describe Application must enforce
Tool inputs shape and documented values trusted identity, object access, business policy
Resources URI and content representation tenant filtering, ownership, retention, deletion
Sampling or model requests capability negotiation budget, consent, destination, privacy
Transport message delivery endpoint trust, session lifecycle, replay and limits

Pin the specification, transport, SDK/runtime revision, tool catalog, and test fixtures that your deployment actually uses. Protocol fields and SDK APIs evolve.

Schema Is Validation, Not Authority

JSON Schema can reject malformed input. It cannot prove that a customer owns an order, a requested price is current, or a deletion is permitted. A model-generated identifier, a tool annotation, and a successful schema validation are all untrusted evidence.

python 
def authorize_tool(session, request, orders):
    if request.tool != "request_cancel_order":
        return {"status": "rejected", "reason": "unknown_tool"}
    order = orders.get_for_subject(request.order_token, session.subject_id)
    if order is None or order.status != "open":
        return {"status": "rejected", "reason": "not_cancellable"}
    return {"status": "confirmation_required", "order_id": order.public_id}

This is application policy, not MCP code. An effectful endpoint must recheck the authenticated subject, tenant, current object state, confirmation binding, expiry, idempotency key, and business invariants immediately before execution.

Build an Application Control Plane

Use controls around the protocol boundary:

  1. derive subject, tenant, and roles from trusted authentication middleware;
  2. allowlist tools per workload and bound input, result, file, and egress size;
  3. authorize each object retrieval and action at the owning service;
  4. treat every tool result, resource, prompt, annotation, and remote URL as untrusted content;
  5. require explicit confirmation and durable idempotency for external or destructive effects;
  6. enforce budgets, timeouts, queues, cancellation, and concurrency locks outside model output;
  7. record redacted policy decisions and lifecycle evidence.

Do not expose arbitrary SQL, shell execution, filesystem paths, or unrestricted HTTP fetches as generic Agent tools.

Resources, Results, and Concurrency

Resources can be convenient references; they are not permission scopes. Authenticate and authorize every retrieval, scope cache keys by tenant and subject, bound subscriptions, and propagate deletion to derived indexes and caches.

Tool results may contain prompt injection, oversized files, misleading URLs, or private data. Limit MIME types, bytes, nesting, redirects, and retention. Render external content as data, not instructions.

For competing writes, use the owning system's transactions, optimistic version checks, locks, or workflow state machine. An Agent protocol cannot resolve a business conflict merely by serializing messages.

Test Failure Paths

Test Failure to demonstrate
Authorization cross-tenant token, model-supplied object ID, stale role
Effects duplicate retry, timeout after execution, expired confirmation
Results injected instruction, oversized artifact, unsafe URL
Concurrency conflicting update, cancellation race, partial failure
Privacy sensitive telemetry, cache leak, incomplete deletion
Recovery unavailable tool, retry classification, outcome_unknown

Measure completion and recovery on representative tasks. Do not claim universal latency or security guarantees without a workload-specific experiment and evidence.

FAQ

Can MCP prevent an Agent from bypassing policy?

Only if the application places the relevant service, credentials, network egress, and action endpoints behind enforced controls. A protocol alone cannot prevent an alternate privileged path.

Is RBAC enough?

No. RBAC may help coarse authorization, but sensitive operations usually also need tenant and object checks, purpose, current state, approval, rate limits, and audit.

What should be logged?

Log redacted correlation IDs, policy decisions, tool revision, result class, latency, and failure class. Do not default to raw prompts, secrets, private artifacts, or hidden model reasoning.

Further Reading