A protocol is not a permission model
MCP standardises how a model discovers and calls tools. It does not decide which caller may call which tool on whose behalf. In an enterprise those questions already have answers in identity, entitlement and audit systems — the work is connecting them.
What a gateway should own
We consistently place a gateway between agents and MCP servers.
- Identity propagation, so a tool call carries the acting user's entitlements.
- Tool-level allow lists per environment and per agent.
- Rate, cost and blast-radius limits.
- Structured audit records for every invocation and result.
References
- Model Context Protocol specification — Public specification