We wrapped our talk at
@mcpsummit Mumbai 2026 ๐
๐๐น๐ผ๐๐ถ๐ป๐ด ๐๐ต๐ฒ ๐๐๐๐ต๐ญ ๐๐ฎ๐ฝ ๐ถ๐ป ๐ ๐๐ฃ: ๐ฃ๐ผ๐น๐ถ๐ฐ๐-๐๐ฟ๐ถ๐๐ฒ๐ป ๐ง๐ผ๐ผ๐น ๐๐ป๐๐ผ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐๐ผ๐ป๐๐ฟ๐ผl -ย delivered alongside the amazing
@sonali_talks
MCP has done a remarkable job standardizing how AI agents talk to tools. But one question remains unanswered in the spec today:
๐ Who authorized that tool call?
There's no native primitive for it. And in multi-tenant production environments, that gap is real. Thanks to Shannon Williams as well for raising this in his Keynote as well.
We walked through four threat patterns we've seen:
๐ด Cross-tenant tool calls - Agent A accessing Tenant B's data, unchecked
๐ด Phantom agent identity - audit log shows a service account, not the human
๐ด Unconstrained parameters - nobody validated what the agent passed to prod
๐ด Privilege escalation chains - each hop loses the original human's context
And then we showed a demo on this and how to solve it.
The stack:
โ๏ธ containers/kubernetes-mcp-server -ย real MCP server, zero changes
๐ก๏ธ
@kyverno - CNCF graduated policy engine
๐ An AuthZ proxy that models every tool call as a Kubernetes CR
Three Kyverno policies:
โ
Tool allowlist - deny by default, per agent
โ
Tenant isolation - structural, not middleware
โ
Human identity injection - tamper-proof audit annotations at admission time
The best part? We didn't change a single line of the MCP server.
Huge thanks to Sonali for co-presenting and to the MCP Dev Summit team for such an energetic event ๐
Slides :
docs.google.com/presentationโฆ
Blog post :
improving.com/thoughts/mcp-aโฆ
GitHub repo with all the manifests, policies, and setup scripts:
github.com/oshi36/mcp-authz-โฆ
#mcpdevsummit #AIagents #mcp #kyverno