Model Context Protocol (MCP) gives AI applications a standard way to discover context and invoke capabilities. That interoperability is useful—and it sharpens an old security question: what should happen between an agent deciding to use a tool and the tool actually running?

An MCP server can expose tools that read data, change records, trigger workflows, or call downstream services. Authentication can establish which client is connecting. It does not, by itself, decide whether a particular action is appropriate for that identity, purpose, resource, and moment.

An AI agent presents a valid JWT and asks an internal finance API to create a payment. The identity is authentic. The token is unexpired. The route is permitted by the agent's role.

Should the request execute?

An AI agent sends this request:

POST /v1/customers/1287/refunds
Authorization: Bearer eyJ...
Content-Type: application/json

{
  "amount": 1200,
  "reason": "Customer reported duplicate charge"
}

At 02:14 UTC, an autonomous agent sends DELETE /v1/customers/4821. The upstream API returns 204 No Content. At 09:00, an operator asks a simple question: why was that action allowed?

An access log can show that a request reached the service. An application log may show that a handler completed. A distributed trace can connect gateway and upstream spans. None of those records necessarily explains which agent acted, what intent was inferred, which policy result applied, what risk was calculated, whether human review occurred, or which final outcome the governance layer selected.

An autonomous agent wants to update a customer record. Its HTTP request looks ordinary:

PATCH /v1/customers/42
Content-Type: application/json

{"creditLimit": 50000}

A conventional reverse proxy can terminate TLS, authenticate the caller, apply a rate limit, select an upstream, and forward the request. Those are essential controls. But the proxy still faces an agent-specific question: is this request a routine update, an unauthorized financial change, a confused tool call, or an action that should wait for human approval?

An AI agent presents a valid JWT and asks a billing API to issue a refund. The token is correctly signed, unexpired, and belongs to the expected agent. Is that enough to execute the request?

No—but not because authentication failed.

Authentication did its job: it established a verifiable identity for the caller. The remaining questions are different. Is the refund within the agent's assigned policy? Does the request express the intent the endpoint is meant to serve? Is the action unusually risky for this agent? Has the agent recently produced violations or required repeated human intervention? Should the request be allowed, denied, or held for review?