Separate proposal and execution
An agent should be able to propose a privileged action through an authenticated path. The trusted executor validates the request, checks authorisation and holds the credential that can carry out the action. Scope that credential to its supported tools and store it outside the agent’s runtime.
For an MCP-connected system, transport authorisation controls access to the server. A tool-level decision can still be required to authorise a specific resource, refund amount or delegated action.
Inventory every route
Check direct endpoints, alternative tool connections and credentials exposed through the environment or inherited service roles. If an agent can reach a protected tool with equivalent credentials, that path needs the same enforcement or its access must be removed.
Verify the result from the actual runtime. A diagram can show the intended flow, while a direct call with available credentials tests what the downstream service accepts.
Test failure and change
Repeat the bypass tests whenever an integration, credential or role changes. Simulate an unreachable policy service and a rotated downstream credential. A privileged action should stay blocked if authorisation cannot be established, and the failure should be distinguishable from a policy denial in the trace.