{
 "slug": "intelligence-cannot-mint-permission-mcp-security",
 "topic_id": "TOPIC-013",
 "cluster": "Agentic Commerce & MCP Tool-Call Gating",
 "tier": "Tier A",
 "title": "Intelligence cannot mint permission",
 "summary": "Give an agent an API key and it inherits ambient authority. Prompt injection, a hallucination loop or an ordinary bug then executes consequential actions with no record binding a human to any of them.",
 "lede": "There is a category error at the base of enterprise agent deployment. Capability is being treated as authority. A system that can do something is being permitted to do it, and the permission is a credential rather than a decision.",
 "date": "2026-06-15",
 "category": "Developer",
 "author_id": "desmond-okafor-hale",
 "tags": [
  "AI agents",
  "MCP",
  "Model Context Protocol",
  "authorization",
  "prompt injection",
  "agent security"
 ],
 "image_title": "Intelligence Cannot Mint Permission",
 "schema": "Article",
 "key_takeaways": [
  "An API key is a bearer credential. Handed to an agent, it conveys everything the key can do, with no relationship to what anyone intended the agent to do.",
  "The Model Context Protocol standardises tool discovery and invocation, including human-in-the-loop prompts. It does not define a signature, a receipt, or a non-repudiable record of the human's decision.",
  "The separating principle is simple: the human signs the rendered effect, not the prompt and not the plan."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The proposition, stated flatly"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "Four very different causes, one indistinguishable outcome",
   "caption": "The credential authenticates the caller. It has no concept of why.",
   "nodes": [
    {
     "label": "User instruction",
     "note": "intended"
    },
    {
     "label": "Injected instruction",
     "note": "from a document",
     "bad": true
    },
    {
     "label": "Hallucination loop",
     "note": "no instruction at all",
     "bad": true
    },
    {
     "label": "Ordinary bug",
     "note": "no intent",
     "bad": true
    },
    {
     "label": "API call executes",
     "note": "identical in all four",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Intelligence cannot mint permission. A model's competence at a task is not evidence that anyone authorised the task, and no amount of reasoning quality substitutes for a decision by a principal."
  },
  {
   "type": "p",
   "html": "That sounds obvious written down. It is violated by the default architecture of nearly every agent deployment in production, because the mechanism that conveys capability — a credential — is also the mechanism that conveys authority. They are the same object."
  },
  {
   "type": "h2",
   "text": "Ambient authority, and why it is the default"
  },
  {
   "type": "p",
   "html": "An agent needs to act, so it gets credentials. The credentials carry whatever permissions the account holds. From that moment the agent's authority is not what a human decided; it is the union of everything its credentials can reach."
  },
  {
   "type": "table",
   "head": [
    "What the human intended",
    "What the agent can do"
   ],
   "rows": [
    [
     "Summarise this quarter's invoices",
     "Everything the finance API key permits, including creating payment orders"
    ],
    [
     "Triage this ticket queue",
     "Everything the service account permits, including closing incidents and modifying records"
    ],
    [
     "Draft a reply to this customer",
     "Everything the mail credential permits, including sending to any recipient"
    ],
    [
     "Check whether the migration ran",
     "Everything the database role permits, including DDL"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The right column is not a security failure. It is the credential working exactly as designed, and it is why every incident in this class reads the same way afterwards: the agent did something nobody wanted, using access nobody had deliberately granted for that purpose."
  },
  {
   "type": "h2",
   "text": "Three ways the gap gets exercised"
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">Indirect prompt injection.</strong> The agent reads content it was asked to process, and that content contains instructions. The agent follows them faithfully, because from its perspective they are part of the input.",
    "<strong style=\"font-weight:600\">Reasoning failure.</strong> No adversary. The model concludes that a destructive action is the right next step — dropping a table to resolve a schema conflict, sending a communication to resolve an ambiguity.",
    "<strong style=\"font-weight:600\">Scope drift.</strong> The agent chains tools legitimately and arrives, several hops from its starting point, at an action nobody considered when the credentials were issued."
   ]
  },
  {
   "type": "p",
   "html": "Defences against the first are an active research area and they are probabilistic. The second and third have no detection story at all, because nothing anomalous occurs."
  },
  {
   "type": "h2",
   "text": "What MCP provides and what it does not"
  },
  {
   "type": "p",
   "html": "The Model Context Protocol has been valuable precisely because it standardised the thing that most needed standardising: how a client discovers what tools a server offers, how it invokes them, and how a server can request human input during an interaction."
  },
  {
   "type": "p",
   "html": "It is worth being accurate about the boundary of that contribution."
  },
  {
   "type": "table",
   "head": [
    "Capability",
    "In the protocol?"
   ],
   "rows": [
    [
     "Tool discovery and schema description",
     "Yes"
    ],
    [
     "Tool invocation and result handling",
     "Yes"
    ],
    [
     "Requesting human input mid-interaction",
     "Yes"
    ],
    [
     "A signature over what the human approved",
     "<strong style=\"font-weight:600\">No</strong>"
    ],
    [
     "A receipt verifiable outside the client",
     "<strong style=\"font-weight:600\">No</strong>"
    ],
    [
     "Binding an approval to a specific tool call's arguments",
     "<strong style=\"font-weight:600\">No</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "That is not a criticism. A wire protocol for tool calling is not obliged to solve non-repudiation, and protocols that try to solve everything tend to solve nothing. The point is that the last three rows are where enterprise deployments need an answer, and the answer has to come from somewhere."
  },
  {
   "type": "h2",
   "text": "Sign the effect, not the intent"
  },
  {
   "type": "p",
   "html": "This is the design rule that does the most work, and it is counterintuitive enough to state carefully."
  },
  {
   "type": "p",
   "html": "An agent system contains three distinct things: the user's prompt, the model's plan, and the concrete action about to execute. It is tempting to have the human approve the first or the second, because that is where the conversation happens."
  },
  {
   "type": "p",
   "html": "Both are wrong. The prompt is ambiguous — <em>pay the outstanding invoices</em> covers a range of outcomes. The plan is a model artefact that may not correspond to what executes. Only the third is a fact."
  },
  {
   "type": "code",
   "text": "prompt   \"settle what we owe Acme\"          ← ambiguous, do not sign\nplan     \"1. list invoices 2. pay each\"     ← model output, do not sign\neffect   \"Transfer 48,200 GBP to Acme Ltd,\n          account 58473920, sort 20-00-00,\n          value date 2026-09-18\"            ← sign this"
  },
  {
   "type": "p",
   "html": "Signing the effect makes injection irrelevant. A poisoned webpage can cause the agent to construct any action it likes; it cannot cause a human to sign a rendered statement of that action."
  },
  {
   "type": "h2",
   "text": "Which effects warrant a signature"
  },
  {
   "type": "p",
   "html": "Not all of them, and a design that gates everything produces approval fatigue, which is its own failure mode with its own article. The test is consequence and reversibility."
  },
  {
   "type": "ul",
   "items": [
    "Irreversible: money movement, data deletion, external communication, production infrastructure change, contractual commitment.",
    "Expensive to reverse: record modification affecting downstream systems, permission changes, published content.",
    "Everything else: read operations, internal drafts, reversible state changes — no gate."
   ]
  },
  {
   "type": "p",
   "html": "In a typical agent workload the first two categories are a small minority of tool calls and nearly all of the risk, which is what makes this affordable."
  },
  {
   "type": "h2",
   "text": "What this does not claim"
  },
  {
   "type": "p",
   "html": "It does not prevent prompt injection, detect it, or make models more reliable. Those are separate and important problems being worked on by people better placed to solve them."
  },
  {
   "type": "p",
   "html": "It makes the outcome of those failures bounded. An injected agent can attempt anything and can complete only what a human signed for, which converts an unbounded failure mode into a bounded one."
  },
  {
   "type": "h2",
   "text": "What bounds the blast radius"
  },
  {
   "type": "table",
   "caption": "Four measures, by soundness",
   "head": [
    "Measure",
    "Soundness"
   ],
   "rows": [
    [
     "Instruct the model not to",
     "Heuristic — the constrained party enforces it"
    ],
    [
     "Classify inputs for injection",
     "Probabilistic — an arms race"
    ],
    [
     "<strong style=\"font-weight:600\">Narrow the credential</strong>",
     "<strong style=\"font-weight:600\">Sound — reduces what any cause can reach</strong>"
    ],
    [
     "<strong style=\"font-weight:600\">Require a human signature on irreversible effects</strong>",
     "<strong style=\"font-weight:600\">Sound — no cause can produce it</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Better models will not hallucinate destructive calls.”</strong> Possibly, and injection and bugs remain. A control that depends on the model being reliable is a control that fails in exactly the cases it exists for."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“A signature per tool call is unworkable.”</strong> It would be. Gate the irreversible subset — payments, permission changes, bulk export, destructive operations — which in most deployments is a handful of tools."
  }
 ],
 "faq": [
  {
   "q": "Does this stop prompt injection?",
   "a": "No. It makes injection unable to produce a consequential action, because the human signature over the rendered effect is not something the injected content can generate."
  },
  {
   "q": "Is this a criticism of MCP?",
   "a": "No. MCP standardises tool discovery and invocation and does that well. Non-repudiation is out of its scope, and the point is that enterprises need it from somewhere."
  },
  {
   "q": "Why not have the human approve the plan?",
   "a": "A plan is model output that may not match what executes. The effect is the only artefact that is a fact rather than a proposal."
  },
  {
   "q": "Does gating slow agents down?",
   "a": "Only on the small minority of tool calls that are irreversible or expensive to reverse. Read operations and reversible actions are untouched."
  },
  {
   "q": "Can prompt engineering solve this?",
   "a": "No. An instruction is enforced by the party being instructed, which is the definition of not being a control."
  },
  {
   "q": "Why render from tool arguments?",
   "a": "Because an injected instruction can also write a reassuring summary. The arguments are what executes."
  },
  {
   "q": "Does every tool call need a signature?",
   "a": "No. Gate the irreversible subset — payments, permission changes, bulk export, destructive operations."
  }
 ],
 "sources": [
  {
   "t": "Model Context Protocol specification",
   "u": "https://modelcontextprotocol.io/specification"
  },
  {
   "t": "OWASP — Top 10 for LLM Applications",
   "u": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
  },
  {
   "t": "Reported incidents involving autonomous agent actions against production systems."
  },
  {
   "t": "W3C Web Authentication Level 2",
   "u": "https://www.w3.org/TR/webauthn-2/"
  },
  {
   "t": "RFC 8785 — JSON Canonicalization Scheme",
   "u": "https://www.rfc-editor.org/rfc/rfc8785"
  },
  {
   "t": "OWASP Top 10 for Large Language Model Applications",
   "u": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
  }
 ],
 "related": [
  {
   "slug": "mcp-human-in-the-loop-gate",
   "title": "Your MCP server can move money. Add the human gate in five lines.",
   "category": "Agents"
  },
  {
   "slug": "indirect-prompt-injection-as-financial-fraud-vector-hidden",
   "title": "Indirect prompt injection as a fraud vector",
   "category": "Developer"
  },
  {
   "slug": "always-allow-most-dangerous-button-enterprise-ai",
   "title": "Why 'always allow' is the most dangerous button",
   "category": "Developer"
  },
  {
   "slug": "delegation-depth-policy",
   "title": "Agent-to-agent delegation depth",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Intelligence%20Cannot%20Mint%20Permission/1200_630/blog.jpg",
 "wordcount": 1178,
 "url": "/blog/intelligence-cannot-mint-permission-mcp-security.html",
 "reading_time": "5 min read",
 "meta_description": "Give an agent an API key and it inherits ambient authority. Injection, a hallucination loop or a bug then executes consequential actions.",
 "hub": {
  "slug": "topics/agent-tool-call-gating",
  "title": "Agent tool-call gating"
 },
 "pair": {
  "slug": "mcp-human-in-the-loop-gate",
  "title": "Your MCP server can move money. Add the human gate in five lines.",
  "mode": "DIFF"
 },
 "answer": "Because the key authorises the caller, not the decision. Everything the agent can reach, it can reach for any reason — a user's instruction, an injected one from a document it read, a hallucination, or an ordinary bug. Nothing between the model and the API distinguishes them.",
 "answer_q": "Why does giving an agent an API key create ambient authority?",
 "glossary": [
  {
   "term": "Ambient authority",
   "def": "Permission a component holds by virtue of its credentials, available to anything that can influence it."
  },
  {
   "term": "Indirect prompt injection",
   "def": "Instructions embedded in content the agent reads rather than in the user's message."
  },
  {
   "term": "Effect rendering",
   "def": "Producing the approval display from the arguments that will execute rather than from a model-written summary."
  }
 ],
 "checklist": {
  "title": "Bounding agent authority",
  "id": "bound",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Separate the reading identity from the acting credential.",
    "text": "Different identities, narrowly scoped."
   },
   {
    "name": "Enumerate irreversible tools.",
    "text": "Usually a handful."
   },
   {
    "name": "Render the effect from the tool arguments.",
    "text": "Not from the model's description of its intent."
   },
   {
    "name": "Verify at the point of effect.",
    "text": "Recompute the digest immediately before executing."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds a named human to an agent's consequential actions through a signed delegation with scope and expiry, and a per-action receipt where the effect is irreversible.",
  "href": "../docs.html",
  "label": "See delegation chains"
 }
}