Tool availability is easily mistaken for permission
An agent may know a tool exists and have enough context to call it, but neither fact establishes that the exact action, target, parameters, or current state are authorized.
MCP · TOOL EXECUTION SECURITY
MCP gives agents tools. It should not quietly give them authority.
INTIGNAI ARBITER places a governed decision boundary between agent context and consequential tool execution: exact scope, current policy, human approval when required, one-use or bounded authority, and reviewable outcome evidence.
THE OPERATING PROBLEM
The hard MCP security question is not whether the agent can call a tool. It is whether this exact call should be allowed now.
Approval can drift away from the exact call
If an approval describes an intention while execution later regenerates different arguments, the human did not approve the action that actually ran.
A successful call is not the same as a verified outcome
For consequential tools, the system needs to know what was attempted, which authority admitted it, what the provider returned, and what state was actually observed afterward.
CONTROL BEFORE AUTONOMY
Make the runtime enforce the boundary so a prompt, model swap, or untrusted context cannot silently redefine authority.
Bind authority to the exact action
Treat tool name, target, arguments, tenant, expiry, expected state, and policy as part of the execution decision instead of relying on conversational intent.
Separate read context from write authority
Agents can gather context broadly while consequential writes remain behind a runtime gate that can allow, deny, hold, or require a human decision.
Return evidence after execution
Record the decision, admitted authority, executor, provider result, verification state, and any uncertainty so later automation cannot treat an ambiguous outcome as proven success.
VERIFY IT
Map one consequential MCP action before you wire it to production.
Use a sanitized example such as sending email, changing a record, publishing content, issuing a refund, running infrastructure commands, or another tool call whose effect deserves an explicit boundary.