Permission should expand only when a concrete step requires it and contract again when that step ends.
Why this question matters
MCP authorization now describes scope challenges and step-up flows for operations that need additional access. This is a better fit for autonomous planning than issuing a broad token at startup. The agent can begin with a small capability set and request more only when its plan reaches a justified boundary.
Step-up alone is insufficient if permissions accumulate forever. Systems need step-down behavior, task-scoped tokens, and policy that distinguishes read, propose, simulate, and execute. A plan should not retain write authority merely because one earlier branch needed it.
Signals worth observing
- An agent starts with scopes unrelated to its immediate action.
- Step-up permissions persist across unrelated tasks.
- A planning agent and an execution agent share the same credential.
Practical control direction
- Issue task- and resource-specific credentials on demand.
- Separate proposal rights from external side-effect rights.
- Expire elevated scopes after the approved operation.
AgentCollusion lensCollusion risk rises when several agents can combine broad residual permissions into an outcome no single grant intended.Sources and further reading
- Model Context Protocol authorization specification
- NIST NCCoE: Software and AI agent identity and authorization
- IETF RFC 8707: Resource Indicators for OAuth 2.0
Next field note: Workload Identity Can Anchor Agent Runtimes
