Authorization Gap

The MCP authorization gap is the missing layer between authenticating access to an MCP server and authorizing a specific tool call for a specific task—a gap that leaves agent tool invocations ungoverned.

Capability vs. authorization is the distinction between what an AI agent is technically able to do (its capabilities) and what it is actually permitted to do (its authorizations)—two concepts that MCP and agent frameworks do not separate by default.

Tool calling lets an agent invoke tools using a protocol like MCP. Authorization decides whether the agent should be allowed to use a specific tool right now—a decision that tool-calling protocols do not make.

The runtime authorization gap is the absence of a policy evaluation layer at execution time in agentic systems—meaning tool calls proceed based on authentication alone, with no per-call access decision.

A service account is a non-human identity used by applications and services to authenticate to cloud platforms and APIs, typically with long-lived credentials and broad permission scopes.

Static credentials are long-lived secrets—such as API keys, passwords, or access tokens—that do not expire on their own and are often shared across multiple agents, services, or environments.

Standing privileges are persistent permissions that remain active whether or not they are being used, giving a workload or agent continuous access to resources beyond what is needed at any given moment.

An overprivileged agent is an AI agent that has been granted more access than is necessary to complete its intended task, increasing the blast radius of misuse, drift, or compromise.