MCP is an interoperability interface between AI applications and tools or data sources; it is not a complete enterprise security or governance architecture. To control what an AI agent can do, an organization also needs to manage identity, authorization and delegation, policy, data and context, execution, network access, and audit. Those seven boundaries are a practical architecture model—not an official MCP or NIST taxonomy.
Is MCP enough for enterprise AI?
No. MCP can standardize how an AI application connects with tools and data sources, but a protocol does not by itself decide who an agent is, whether a particular request is allowed, what data it may use, where its code runs, or how its actions are investigated afterward. The NSA’s security release identifies familiar needs such as authentication, authorization, and input validation alongside agent-specific concerns including dynamic tool invocation, implicit trust relationships, and context sharing. Those concerns span more than one interface. NSA security design considerations for agentic MCP systems.
As an Amazon Associate I earn from qualifying purchases.
The seven boundaries below group documented enterprise concerns into a usable design checklist. They are not mandated categories, nor a claim that seven controls can cover every deployment. NIST’s 2026 NCCoE concept paper explores candidate building blocks for agent identity and authorization, with a stated focus on enterprise use cases where greater control and visibility are possible. It describes project direction, not a universal, established implementation pattern. NIST NCCoE concept paper on software and AI agent identity and authorization.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Boundary | Question the control must answer |
|---|---|
| Identity | Which human, agent, workload, or service is making this request? |
| Authorization and delegation | Is this identity allowed to take this action, for this task, with authority that can be revoked? |
| Policy and governance | Which tools, data, models, and actions are allowed under organizational rules? |
| Data and context | What information can enter the model or tool call, and what can be shared onward? |
| Tool execution and containment | Where does the action run, and what limits its impact? |
| Network and protocol ingress/egress | Which MCP servers and network paths are trusted and governed? |
| Observability and audit | Can the organization reconstruct what happened and why? |
1. Identity: distinguish the user from the agent and its runtime
An enterprise request can involve several identities at once: the human who asked for work, the agent acting on the request, the workload hosting that agent, and a service identity used to reach a tool. Treating them as one generic “AI identity” makes it harder to apply access rules or determine accountability. Preserve the relevant identity context as a request moves between components instead of allowing a tool call to arrive as an indistinguishable application credential.
#1 Best Overall
NIST’s concept paper discusses OpenID Connect for expressing authentication, consent, and authorization information; SPIFFE/SPIRE for workload identity and attestation approaches; and SCIM for identity provisioning and lifecycle management. These address different parts of the problem. They are candidate building blocks, not interchangeable products or a prescription that one mechanism fits every environment. Choose based on what must be identified, how credentials are issued and rotated, and how identity is retired when an agent or workload is no longer trusted. NIST’s discussion of agent identity approaches.
2. Authorization and delegation: constrain each action to the task
Authentication answers who is making a request; authorization determines what that identity may do. An agent should not inherit broad, permanent access simply because a user or service can invoke it. Define which actions are permitted, on which resources, under what conditions, and for how long. When authority is delegated from a user or workload, preserve enough context for the downstream decision point to apply the intended limits—and make it possible to revoke access.
Permission boundaries and identity propagation are also operational concerns in AWS’s agent guidance. The implementation should check permissions at the point where a consequential action is authorized, rather than relying on the model to infer that an action would be inappropriate. NIST’s concept paper discusses fine-grained authorization and applicable Zero Trust guidance; it does not establish one access-control mechanism as the answer for every organization. AWS agent operations guidance; NIST NCCoE concept paper.
3. Policy and governance: make rules enforceable outside the model
Set organizational rules for which agent protocols, models, data sources, tools, and actions are acceptable. Convert rules that must reliably hold into enforceable controls—such as a policy check before a tool call—instead of treating a prompt or the model’s own reasoning as the sole safeguard. Governance should account for requests that cross organizational or system boundaries as well as ordinary user interactions.
AWS recommends governance as code, protocol standards that can evolve, and clear organizational standards for agent operations. These are vendor-authored recommendations, not universal requirements. Separately, NIST’s published summary of comments reports support among commenters for a logically separate governance component that evaluates and enforces requests under defined policies across user interaction, prompt processing, tool and data calls, and cross-boundary requests. That is a summary of public comments, not a formal NIST requirement. AWS governance guidance.
4. Data and context: control what the agent can see and share
Decide which context is necessary for a task, validate inputs before they reach tools, and consider what information a tool response may add to later steps. A system that gives an agent access to a tool also creates a path for context to move through that tool and into subsequent decisions. The NSA flags context sharing as a systemic concern in agentic MCP systems; that warning does not prescribe one universal data-loss-prevention design. Apply data controls that fit the sensitivity of the information and the routes it can take. NSA security design considerations.
5. Tool execution and containment: limit the blast radius
Tool calls can change records, trigger transactions, run code, or expose information. Treat them as consequential actions, not merely as text generated by a model. Validate arguments and outcomes, use bounded execution environments, and require human approval when an action’s impact warrants it. The exact containment design depends on the implementation; MCP itself does not supply that design.
AWS governance guidance recommends designated sandbox environments with clear boundaries, and its operations guidance identifies circuit breakers as an operational concern. A sandbox is useful only if its permissions and connections are actually limited; a nominally separate environment with unrestricted credentials does not contain much. Define what an agent can reach and what conditions stop or pause its work. AWS governance guidance; AWS agent operations guidance.
6. Network and protocol ingress/egress: govern server connections
Inventory the MCP servers an enterprise application can reach, authenticate remote traffic, and set rules for inbound and outbound connections. A client that can discover or connect to servers without central visibility can create paths around otherwise well-defined controls. Consider how new servers are approved, how their access is restricted, and how their connections are monitored.
Microsoft documents an identity-centric MCP firewall approach for visibility, policy enforcement, and runtime protection; the documentation labels the capability as preview, so its status and availability may change. Azure API Management documentation describes JWT-based authentication and authorization patterns as well as MCP server discovery capabilities. These are product-specific options, not properties provided automatically by MCP or required for every architecture. Microsoft MCP firewall documentation; Azure API Management MCP overview.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Observability and audit: keep enough context to investigate
Record enough about agent runs and tool actions to investigate errors, misuse, and compliance questions. Useful records can include the initiating identity, the action requested, the authorization decision, the tool and resource involved, and the result. Decide what to retain and who may inspect it: logs can contain sensitive prompts, outputs, or identifiers, so collection and retention must account for privacy and storage costs.
AWS guidance recommends tracking execution paths and maintaining audit trails. NIST’s concept paper also frames enterprise control and visibility as a project focus. Together, these point to an operational requirement: logs should make an agent’s path understandable, not merely show that a request reached a service. AWS governance guidance; AWS agent operations guidance; NIST NCCoE concept paper.
How to assess an enterprise MCP design
Before deployment, trace a representative task from the user’s request through the agent to each tool and back. At every transition, ask:
- Can you identify the human, agent, workload, and service involved?
- Does the permission decision use relevant identity and task context, and can access be limited or revoked?
- Are policy checks enforced at the point of action rather than left to model judgment?
- Can you identify what data and context may enter each step and move onward?
- Are execution permissions, network access, and failure conditions bounded?
- Can an operator reconstruct the request, decisions, tool calls, and outcomes without retaining more sensitive data than necessary?
Compare implementation choices on identity propagation, authorization granularity, where policy is enforced, isolation, auditability, interoperability, deployment status, and operational burden. A protocol gateway, identity system, policy layer, sandbox, and logging service may each cover part of the design; their presence alone does not demonstrate that the controls work together across the full request path.
What standards do—and do not—settle
NIST’s AI Risk Management Framework 1.0 is voluntary, was released on January 26, 2023, and is being revised. NIST’s AI Agent Standards Initiative describes work to facilitate industry-led standards and community-led protocols. Neither source establishes a mandatory seven-boundary architecture. NIST AI Risk Management Framework; NIST AI Agent Standards Initiative.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The practical distinction is straightforward: MCP can help standardize an interface, while an enterprise must still decide how identity, authority, policy, information flow, execution, connections, and evidence are controlled around it. The seven boundaries provide a way to find those decisions and test whether they hold across an agent’s path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
