An MCP server gives an AI application a consistent way to discover and use tools or resources. It does not remove the need for authentication or authorization. The server still has to establish who is making the request, which tenant and user the request represents, and whether that identity may perform the specific operation.

Keep identity separate from model output

Never let a model choose the acting user, tenant, or role from free text. Bind identity to the authenticated session or service connection and pass it to the MCP server through a trusted channel. Validate tokens for issuer, audience, signature, expiry, and required claims. Short-lived credentials reduce the impact of accidental exposure.

Authorize every tool call

Tool discovery is not permission to execute every advertised operation. Check authorization immediately before the underlying action using the current user, tenant, resource, operation, and business state. Separate read and write tools, and avoid a generic tool that accepts arbitrary URLs, SQL, shell commands, or broad filters.

• Scope credentials to the minimum resource and operation.
• Use server-side tenant filters rather than asking the model to include them.
• Require explicit approval for costly, external, sensitive, or irreversible actions.
• Return structured denials without leaking whether another tenant’s resource exists.
• Record the policy decision, tool, resource, and correlation ID for audit.

Design for delegated access

If the AI application acts on behalf of a user, make the delegation visible and time bounded. Do not replace every user credential with one powerful shared service account. Where a service identity is necessary, restrict it to a narrow backend function and enforce the user-level policy again at that boundary.

Test misuse and failure

Test expired tokens, wrong audiences, cross-tenant identifiers, revoked roles, duplicate writes, prompt-injected tool arguments, and actions attempted after approval has expired. The MCP best-practices guide, least-privilege guide, and RAG security guide cover the surrounding controls.

MCP standardizes the connection. Your application and services remain responsible for deciding who may do what, to which resource, and under which conditions.