Start with the access a system has, the actions it can take and the controls that limit consequences. These articles examine identity, permissions, untrusted input and evidence at the boundary.
Identity, access and action boundaries
Give agents a stop condition at the effect boundary A recent report of unintended model actions shows why an agent needs a defined, testable way to stop at a tool boundary. Permission checks and monitoring must decide the outcome when the task cannot be completed safely. Test where an agent token stops working Measure when every receiving service rejects an agent’s credential after authority is withdrawn. Include cached checks, active sessions and queued work before accepting the access design. Define client trust for MCP metadata documents Client ID Metadata Documents give MCP authorisation servers a resolvable client identifier. Define trusted applications and metadata change controls before treating that identifier as approval to access internal systems. Agents need identities, not API keys An agent needs an identifiable actor, explicit authority and bounded credentials. Preserve the delegating person or organisational owner in the action record, and test scope, expiry and revocation before granting access. Design the action boundary for prompt-injection failure Prompt injection can influence an AI system through untrusted input or retrieved content. Combine prevention and detection with permissions, approval and disclosure controls that constrain the consequences if an attack succeeds.
Next step