01 / Source and scope
Who acts, and what changes?
Principal and authority origin
Organization operating an MCP client or server. System owner and MCP deployment policy.
Consequential action
Expose tools that can alter external systems.
02 / Action-time control
Make the requested effect testable.
Guidance informs design; it does not certify a gateway or replace protocol conformance. Validate transport and server trust, minimize downstream privileges and enforce each consequential tool call.
OriginSystem owner and MCP deployment policy
RequestExpose tools that can alter external systems
DecisionEvaluate and enforce before effect
03 / Evidence and responsibility
Permission, execution, and outcome are separate.
Server inventory, token checks, tool decisions and downstream logs.
ProofGrid can complement MCP controls; the operator owns server hardening, credential handling and path coverage.
Primary source