Author(s): “The AI Engineer”
Originally published on Towards AI.
created by GEMINI
A friend of mine — a backend engineer at a mid-size fintech startup — sent me a message last month that started with “so this is bad.” His team had just shipped an AI agent that used the Model Context Protocol (MCP) to connect to their internal tools: a CRM, a billing system, and a Slack workspace. It worked beautifully in the demo. Then, during a routine security review, someone noticed the agent still had full read/write access to a tool it hadn’t used in three weeks — access that was never explicitly revoked, because nobody had built a way to revoke it.
Nothing was breached. No data was stolen. But the gap was real, and it wasn’t a bug in his code. It was a structural weak point that shows up in almost every MCP integration being shipped right now: the authorization layer is an afterthought, not a foundation.
