MCP gateway and executor authority

01 / Principal and identity

Who acts, and what can the platform identify?

An MCP client agent calls a server that may use its own downstream identity.

The gateway can validate client token and tool call; the executor knows final target and API result.

02 / Action-time control

Where can an unauthorized effect be stopped?

Validate resource/audience and coarse scope at gateway; enforce exact action at the downstream executor.

Bind client, task, tool name, normalized arguments and grant.

Delegation constraint

A server must not convert a client’s broad tool visibility into downstream authority.

03 / Worked denial

Test a request outside the grant.

A valid MCP client calls update_customer with another tenant’s ID.

Adversarial verification

Call update_customer with a token for the wrong MCP resource, then retry with a valid token but wrong tenant. Confirm transport and executor deny different failures.

04 / Review and responsibility

What should the audit trail prove?

Token validation result, request ID, tool/arguments, decision, downstream call and record state.

Gateway-only enforcement fails if alternate routes reach the protected API.