Agent Identity and Delegated Authority Across MCP Servers

[josuesafari]

As AI agents increasingly use MCP servers to access tools, data, and external services, it may become difficult for users to understand and control the authority delegated to those agents.

For example, if an agent is authorized to perform an action through an MCP server, how can the user clearly determine:

• Which agent is actually acting?
• On whose behalf is it acting?
• What permissions were originally granted?
• What actions is the agent currently authorized to perform?
• Can those permissions be delegated to another agent or MCP server?
• Can the user trace the chain of authorization when multiple agents are involved?
• How can the user revoke or limit that authority consistently across different agents and MCP servers?

This becomes more important as users begin working with multiple agents from different providers and allow them to interact with increasingly sensitive tools and services.

I would be interested to know whether this is already considered a problem within the MCP ecosystem, and how others are currently addressing it.

[linear-code]

ENG-3298

[0xbrainkid]

A useful distinction here is identity vs. authority. The agent identity answers who is acting; the principal and delegation chain answer on whose authority and within which scope. For an MCP registry entry, I would keep those fields separate and make delegation independently verifiable and revocable, including audience, expiry, and a stable reference to the authorization record. That avoids treating possession of an agent credential as proof of every represented user permission.

[josuesafari]

Thank you, I completely agree with this distinction. I think the harder problem begins when the delegated authority is no longer a simple one-to-one relationship.

For example, if a user delegates authority to Agent A, Agent A delegates part of a task to Agent B, and Agent B uses an MCP server or another external service, how can we reliably determine whether the final action is still within the authority originally granted by the user?

In such a multi-agent chain, identity can tell us who performed the action, but we also need to establish the origin, scope, purpose, expiration, and propagation of the authority behind that action.

I am particularly interested in how MCP ecosystems could represent and verify this kind of transitive delegation while keeping it revocable and auditable across agents and tools.