01 / The operating case
What changes in a real workflow?
One compromised search server process runs alongside a billing tool and can reach the billing API with a shared service account.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Separate workloads and credentials by trust domain, constrain egress and secret access, and validate tenant and action at the billing executor.
03 / Failure and evidence
What goes wrong, and what can be proven?
A single broad server identity turns one tool compromise into billing control.
Keep workload identity, egress attempt, downstream denial and affected tenant scope.
04 / Canonical scope
Why this reference stands alone
Cross-tenant isolation concerns tenant data separation; this page owns workload containment.
Protocol or attack trace
Compromise containment
Search server process is compromised and tries to use sibling billing server credentials.
Search workload cannot read billing secret or reach billing API; billing executor also denies its identity.
Primary references