Microsoft Entra Agent ID and SD-JWT agent identity solve registration, governance, and authentication — but they don't decide whether a specific MCP tool call is permissible right now. This article explains the gap and the runtime authorization architecture needed to close it.
Treating AI agents like service accounts is a useful starting point — but it fails at runtime. Here's why scoped tokens are necessary but not sufficient, and how runtime authorization fills the gap.
Atlassian Rovo's MCP server makes a precise security tradeoff visible: OAuth 2.1 handles identity and consent; API tokens handle non-interactive automation. Neither governs what agents can actually do at tool-call time. Here is what that gap looks like in practice.
Fine-grained authorization as a service. RBAC, ABAC, and ReBAC for applications, APIs, and AI agents. Policy as code, a no-code editor, and local PDPs.
