01 / The operating case
What changes in a real workflow?
A client has a valid token for a customer MCP server and calls delete_customer for an account outside its ticket.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Validate resource audience, resolve caller and task, normalize tool name and customer ID, evaluate scope and enforce before the downstream delete.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A valid token or visible catalog entry is treated as permission for every tool invocation.
Evidence to retain
Record token audience result, tool schema version, request digest, decision and customer API outcome.
04 / Canonical scope
Why this reference stands alone
The MCP conceptual reference explains why; this guide describes the invocation boundary and inputs.
Illustrative implementation artifact
MCP tool-call sequence
validate token issuer, expiry and MCP resource audience
resolve principal and current task
normalize tools/call name and effectful arguments
evaluate exact action and target
DENY unless current result binds to this request
invoke downstream with separate scoped credential
correlate decision, attempt and observed outcomePrimary references