Mission & stopping conditions
Define success, prohibited actions and when the agent must stop.
- Avoid vague goals
- Set duration and transaction limits
Agentic AI & MCP / 2026
Let agents plan. Do not let them inherit unlimited authority.
Agentic AI can pursue goals across multiple steps and systems. That makes identity, tool permissions, memory, authorization and human approval part of the security boundary.
MissionNarrow
IdentityDedicated
ToolsAllowlisted
OverrideReady
Agent boundary
Goal → model → memory → context → tools → action.
Every transition can introduce manipulated instructions, excessive permissions or misunderstood consequences.
Dedicated identity
Give the agent its own identity rather than sharing an administrator or user session.
- Minimum scopes
- Short-lived credentials
- Separate environments
Memory & context
Treat memory and retrieved content as potentially stale, poisoned or over-broad.
- Source provenance
- Expiry/review
- Per-user access controls
Tool calls
Treat each invocation as an API security decision.
- Schema validation
- Allowlists
- Rate limits and audit logs
Approval gates
Place human review at the point of consequence.
- Payments
- Security/account changes
- External communication
Safe failure
Design rollback, credential revocation and a tested kill switch.
- Stop downstream automation
- Preserve evidence
- Recover from known-clean state
MCP security
Connection does not equal trust. Capability does not equal authority.
MCP connects AI applications to external systems; secure implementations need authorization, resource-bound tokens, access control and consent.
Authorize the right resource
Tokens should be intended for the MCP server that receives them.
- No token passthrough
- Validate resource/audience
Constrain servers & tools
Approve which servers and tools are allowed in each environment.
- Inventory connections
- Separate test/production
- Block unknown servers
Validate inputs & outputs
Tool interfaces need API-grade validation.
- Validate parameters
- Sanitise outputs
- Rate limit
Protect consent
Users need enough context to understand what a tool will access or change.
- Show action and target
- Confirm sensitive operations
Observe & revoke
Log scopes and sensitive invocations so access can be removed quickly.
- Central logs
- Token revocation
- Anomaly review
Careful adoption
Start with repetitive, well-defined and low-risk work.
Increase autonomy only after evidence shows safe behaviour under normal, failure and adversarial conditions.
Start low risk
Use bounded internal tasks before high-impact workflows.
Red-team workflow
Test indirect injection, malicious tools, poisoned memory and approval bypass.
Measure outcomes
Track errors, blocked actions, overrides and security events.
Expand deliberately
Increase tools or autonomy one controlled change at a time.
Human-controlled AI defence
Build capability without losing authority.
Start with the real workflow, data, identities, tools and consequences. Then place controls where they can stop harm.