Topic
Enforcing per-user access control for autonomous agents that query multiple data sources on a user's behalf.
Agentic AI Foundation's September 28 MCP release finalizes stateless servers and bars removing deprecated features before July 2027. Teams moving servers off sessions now have a dated floor to plan migrations against.
Reality
An engineer writing on dev.to traces the tenant-and-user token that scopes every query in multi-tenant SaaS, and what breaks when the caller is a process choosing its own API calls on a user's behalf.
Reality
A developer suspended a signed-in test user while that user's Claude agent was still running, and the app kept reading the token as valid, so enforcement has to move into a status check the application itself owns.
Reality
A dev.to roundup reads three agent papers around one design question: what a pending action still depends on at the moment it fires. The strongest number in it is 68 percent, and it belongs to somebody else's corruption test.
Reality
An agent is not a legal person, so a dev.to post argues that only contemporaneous authorization evidence, a scoped credential valid at the moment of signing, can tell a governance failure apart from a bad deal.
Reality
Removing initialize and Mcp-Session-Id lets MCP servers sit behind a plain round-robin load balancer. The handle pattern that replaces them keeps whatever authorizes the next call in the same buffer as attacker-controlled text.
Reality
IBM's survey of 2,000 technology chiefs puts full readiness for agent deployment at 11%. The gap that shows up in production is authorization, where a limit written per action never sees the sequence it sits in.
Reality
A single developer's capability layer for AI agents is pre-1.0 and self-reviewed. The primitive it argues for is still the floor: scoped, signed, dated, revocable, recorded.
Reality
Beyond Zero extends zero trust into per-action authorization for humans and agents. The evidence is still internal to Alphabet, but the vocabulary is what reaches your audit committee.
Reality
A new Bedrock AgentCore pattern from AWS treats the agent as an orchestrator with no say over access, pushing per-user enforcement down to DynamoDB, Knowledge Bases and Salesforce.
Reality