01 / The operating case
What changes in a real workflow?
A shared server holds a powerful database credential. An agent with read permission attempts a destructive SQL operation through a permissive tool.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Use least-capable downstream credentials, isolate tenants, validate caller and arguments, enforce tool-specific policy and constrain outbound access.
Architecture review / negative test
Make the boundary testable.
Review the server as a privileged service: its downstream credentials, network egress, tool implementations, tenant partition and update process all matter. A tool description is metadata controlled by the server, not a security guarantee. Restrict the server’s own capabilities where possible so a failed policy does not expose a universal credential.
03 / Failure and evidence
What goes wrong, and what can be proven?
Server credential scope becomes the effective agent permission because downstream systems cannot see the initiating principal.
Correlate client identity, tool call, policy and database outcome; do not log secrets.
04 / Canonical scope
Why this reference stands alone
Client security examines which server is trusted; this page owns server-side deployment and downstream isolation.
Primary references