01 / The operating case
What changes in a real workflow?
A shared MCP server calls a database with its own privileged credential.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision contract
What the executor must check
Pass authenticated client, agent, origin grant and call ID as trusted context; enforce at the server or downstream database proxy.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The downstream log shows only the server, so one client can borrow another client’s privilege.
Evidence to retain
Correlate client call, server policy decision, database query and observed result.
04 / Canonical scope
Why this reference stands alone
Human-to-agent attribution covers the initiating person; this page owns the agent-to-executor hop.
Technical artifact
Carry trusted caller context across an MCP server
client principal C + task T + call ID Q MCP server S validates C and T S invokes database with its own credential DB audit: Q and constrained actor context join C → S → DB result
Run the denial test
Send an arbitrary “user-id” string in a tool argument. The server must not treat it as authenticated caller identity.
Primary references