What happened
On 20 October 2026 the Cloud Security Alliance published an analysis proposing a two-gate authorization model for Model Context Protocol (MCP) and agentic AI: Gate 1 'Capability Admission' (whether a capability should be exposed to an agent at all, via least-capability-first tool curation and tools/list filtering) and Gate 2 'Execution Authorization' (whether a given use of the capability is authorised against a specific resource, by a trusted enforcement point outside the model). It argues that MCP tool discovery (tools/list) is risk reduction, not an authorization boundary; that MCP server access must not collapse into tool access; and that agentic authorization needs agent, workload, authority-origin, operation, resource and context signals rather than just a valid access token.
Why it matters
CSA is a recognised standards-adjacent body, and this piece formalises an emerging control pattern for the agentic-AI authorization gap: separating capability admission from execution authorization and applying least-capability before least-privilege. It can be used as a design reference and cross-maps to CSA's own agentic runtime work and to OWASP's excessive-agency guidance. It is interpretation/companion guidance rather than a published norm, so it belongs on the watch list for downstream standardisation.
Action needed
Designers of MCP tool-to-agent integration should adopt the two-gate separation, curate the capability surface exposed to each agent, and place a trusted enforcement point outside the model to authorise consequential tool calls against the specific target resource.