Access Control and Secrets
Separate human, service, connector, and agent permissions, then connect least privilege, secret rotation, approval gates, and audit evidence.
Written and reviewed by Eric Han · Co-founder & CTO, reopt
Key takeaways
- Separate human, service, connector, and agent permissions, then connect least privilege, secret rotation, approval gates, and audit evidence.
- Use this chapter as a first-pass operating checklist before changing systems, data, permissions, or customer-facing workflows.
- Validate platform-specific details against current official docs or internal policy before rollout.
MCP boundaries: token audience and OAuth URLs
Current MCP security guidance forbids accepting tokens not issued for the server and passing them unchanged to downstream APIs. Validate the intended resource/audience and resolve downstream credentials separately. MCP proxies need per-client consent and exact registered redirect URI matching for third-party OAuth flows.
Server-side clients fetching OAuth metadata should enforce HTTPS and address policy on the initial URL and every redirect. Restrict private, loopback, link-local, and cloud metadata access according to the environment; test DNS and IPv6 bypasses. Avoid hand-written prefix checks. Explicitly design exceptions for private enterprise MCP endpoints.
| Regression case | Expected result |
|---|---|
| Valid token for another resource | Authentication rejected |
| Tenant A approval used for tenant B access | Execution-time authorization rejected |
| Permission revoked while approval is pending | Recheck and reject before dispatch |
| Public OAuth URL redirects internally | Network policy rejects before fetching |
AI systems introduce a new permission actor: the agent. It may read, decide, and trigger tools on behalf of a user or workflow, so access control must be explicit.
Identity Types
| Identity | Control need |
|---|---|
| Human user | Role, tenant, consent, session |
| Service account | Scoped API access and rotation |
| Agent runtime | Task-scoped permissions and audit |
| Tool connector | Least privilege and data filtering |
| Administrator | Break-glass policy and monitoring |
Secret Rules
- Store secrets in approved secret managers or platform environment variables.
- Never put secrets in prompts, memories, documentation examples, or logs.
- Rotate keys with no expiration or unclear owner.
- Separate development, staging, and production credentials.
- Monitor privileged token usage and failed access attempts.
Approval Gate
Any AI-initiated action that changes money, customer records, permissions, legal status, or production state should require explicit policy and human review.