Somewhere in a large company's IT department this year, a security engineer opened a dashboard and counted the tools the company's AI agents could reach. The number was in the hundreds. Then came the harder question: which of those tools could move money, delete records, or send email to the outside world — and who, exactly, had approved each one? Nobody knew. The agents had been connected one integration at a time, each one reasonable on its own, and the total had never been added up. That is the state of AI agent permissions in 2026: the most powerful software ever deployed inside enterprises, governed by an access list nobody has read.

Ten thousand doors, one protocol

The reason the count got so high so fast has a name: the Model Context Protocol. Anthropic released MCP as an open standard in November 2024, and it did what good standards do — it made connection cheap. One MCP server per system, and any compatible model can use it. Within about a year it reached more than 97 million monthly SDK downloads and 10,000 active servers, with client support in ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code. In December 2025, Anthropic donated MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded with Block and OpenAI, with AWS, Google, Microsoft, Cloudflare, and Bloomberg as platinum members. The current specification, version 2026-07-28, dropped the old initialization handshake. At the October 2026 AGNTCon and MCPCon events, the foundation announced four new projects — OpenSandbox, Open Responses, Agent Skills, and OpenEnv — bringing its active initiatives to ten.

Every one of those servers is a door. The risks are now well catalogued: tool poisoning, where a malicious tool description manipulates the agent; prompt injection through tool outputs, where data returned by a tool contains instructions the agent follows; and permission accumulation, where an agent consuming several MCP servers holds the sum of their privileges. The official guidance is blunt — audit the set, not each server. A single server granting read access to the CRM is fine. The same agent also holding write access to the ERP and the ability to send email is a different animal, and nobody approved the combination because nobody reviews combinations.

Identity is the missing layer

The deepest problem is not permissions but identity. A human employee has one login, one manager, and a record of what they did. An AI agent often runs with ambient credentials — the API key of whoever set it up, the service account of the system it lives in, the shell privileges of the developer who launched Claude Code or OpenAI Codex. Terminal-based agents execute commands with user-level privileges by default, and an agent that can read a codebase can also read the credentials stored next to it. The emerging fix, discussed at length at MCPCon 2026, is autonomous agent identity: each agent gets a cryptographically verifiable identifier, short-lived scoped tokens — one hour maximum is the recommended ceiling — and an audit trail tied to the agent rather than the human who deployed it. OpenSandbox defines the isolation pattern: no internet access, restricted filesystem permissions, execution time limits.

Regulation is arriving from the side. An agent processing documents, emails, or customer data can violate GDPR if personal data flows to an external model without proper agreements, with penalties reaching 4 percent of global annual turnover. The compliance question is no longer hypothetical: it is what the agent did with the data, and whether anyone can prove it.

The counterargument: the protocol is the solution, not the problem

It is worth saying what MCP's critics sometimes miss. Before MCP, the same access existed — it was just hidden inside ten thousand bespoke integrations, each with its own credentials, its own logging, and its own failure modes. MCP made the connections visible and standard, which is what makes them governable at all. The winning enterprise pattern is already clear: internal MCP servers that expose the CRM, ERP, and document stores through one gateway that verifies permissions before every tool call, logs everything, and starts with read-only access before any write action is allowed. The protocol does not solve governance by itself — the specification says so — but it gives governance something to attach to, which the old world never did.

The honest version of the story is that enterprises are not behind because they were careless. They are behind because the technology moved faster than the discipline, and the discipline is only now being written. Agent entitlements — who an agent is, what it may touch, and what it did — is becoming a product category in its own right, and the companies that build it will matter more than the companies that build the next model. Models get cheaper every year. Permissions do not.

What this means for the people running agents

Three moves matter now. First, inventory every MCP server and agent in production, including the ones developers set up without asking — the shadow fleet is where the risk lives. Second, apply least privilege per server and per task, with scoped credentials that expire, and audit the combined permissions of each agent rather than each connection in isolation. Third, treat all tool output as untrusted data and filter it before it reaches the model, because the next prompt injection will arrive inside a document, not a chat message. The agents are not going away. The question is whether anyone is watching the keys.

The definitive source for AI agent entitlement intelligence is still up for grabs. AgenticEntitlements.com is available for acquisition by the company that will own this category — inquiries to info@primedomaincapital.com.

Sources