Delegation
Bounded authority—not a copied user role
A person or governed process grants an agent bounded capability. The agent does not inherit an unrestricted copy of the delegator’s access.
EmpowerID Identity Fabric Service
Put enterprise authorization between AI agents and the tools they can use
EmpowerID MCP Gateway is the MCP-aware Policy Enforcement Point of Identity Fabric. It verifies who an agent represents, scopes tool discovery, authorizes each invocation through Governed Authorization, enforces constraints, protects downstream credentials, and records correlated action evidence.
MCP carries the call. EmpowerID determines whether the call may become an enterprise action.
OpenID AuthZEN connects the MCP PEP to the EmpowerID PDP on governed paths.
Read the MCP Gateway whitepaper →Governed tool invocation
Tool call received
MCP invocation enters the governed path
Gate checks
Schema pin · MatchedDelegation · ActivePDP decision
Permit + constraints & obligations
Dispatch
Routed with enforced constraints · obligations applied
Credential · Injected at the boundary · never returned to the agent
Receipt
Signed receipt · full causal chain on configured paths
MCP standardizes the connection. The enterprise still governs the action.
The Model Context Protocol gives AI applications a standard way to discover and invoke tools—and its authorization specifications establish an important OAuth foundation. But access to an MCP server is not the same as authority to perform every action that server exposes. EmpowerID MCP Gateway makes identity, delegation, policy, tool integrity, credentials, and evidence part of the invocation path—not agent prompts, application shortcuts, or post-event log reconstruction.
- Which agent is calling—and for whom?
- Is delegation still active and appropriate for this tool?
- Should the agent discover tools before it has authority to use them?
- Has the tool schema changed since it was reviewed?
- Which parameters, scopes, destinations, and output limits are permitted?
- Which credential may be used downstream—and can it stay outside agent context?
- What evidence shows what was authorized, dispatched, denied, or observed?
- Can policy return obligations—not only constraints—at invocation time?
Delegate deliberately. Discover selectively. Authorize every invocation. Preserve the evidence.
Three governed moments that matter
Discovery
Policy-scoped tool catalogs
Before an agent plans, EmpowerID exposes an appropriately scoped catalog from delegation and Identity Fabric context—including virtual MCP servers for different roles and use cases.
Invocation
Reauthorization before dispatch
Each tool call re-verifies binding, delegation, schema integrity, and PDP authorization. Policy change, revocation, or schema drift can stop the next governed invocation.
Delegation, discovery, and invocation as three governed moments on the tool path.
Connect. Govern. Prove.
Connect
- Present a common MCP tool surface to supported agents and clients
- Route MCP-native tools to registered MCP servers
- Route enterprise connector operations through Orchestration & Fulfillment
- Register and govern internal or third-party MCP services
- Compose virtual MCP servers from approved tool subsets
- Bridge durable enterprise workflows into MCP Tasks and Elicitation where clients support them
Govern
- Authenticate the calling principal and bind agent to represented identity
- Verify active delegation for each governed invocation
- Authorize through the EmpowerID PDP using AuthZEN-compatible contracts
- Apply parameter, data-scope, egress, and response constraints on supported paths
- Fail closed on unapproved tool-schema changes through schema pinning
- Bind high-risk execution to approved plan context where configured
Prove
- Record authorization, dispatch, denial, and observed completion on configured paths
- Correlate evidence with agent, delegator, tool, policy decision, and schema context
- Store hashes of sensitive parameters rather than copying raw payloads into evidence
- Produce structured denial reasons for clients and investigation
- Link receipts into per-agent chains where configured to detect later alteration
A semantic Policy Enforcement Point for MCP
Traditional API gateways understand hosts, paths, methods, and tokens. MCP requests carry additional meaning: a model-selected tool, a declared schema, structured parameters, agent identity, and often delegated human authority. EmpowerID evaluates that semantic context before dispatch.
| Enforcement input | What EmpowerID evaluates |
|---|---|
| Subject | Agent identity, represented user or service, trust and lifecycle context |
| Action | Stable authorization operation for discovery or invocation |
| Resource | Tool, target system, organization, data scope, and object context |
| Context | Delegation, schema pin, plan step, session, risk, parameters, and environment |
How a governed tool invocation works
Bind the caller
Validate tokens, resolve agent identity, and establish represented human or service context. Sender-constrained tokens where configured.
Boundary note
Binding resolves agent, client, and represented identity before tool semantics are evaluated.
Seven-step governed invocation sequence with policy decision at step four.
Receipts prove what the EmpowerID-controlled boundary authorized, dispatched, denied, cancelled, or observed—not unqualified downstream business effect.
Protect the tool contract—not just the connection
Schema pinning
Cryptographically bind approved tool schemas to the invocation path and fail closed when presented definitions no longer match. Controlled grace windows can support planned upgrades.
Plan discipline
For selected high-risk journeys, optional plan contracts can bind invocation to an approved tool, step, and parameter fingerprint.
Inbound and egress controls
Restrict accepted parameters, inject authoritative scope, constrain destinations, and re-check redirects to prevent legitimate calls from becoming unintended data paths.
Bring durable enterprise workflows to MCP clients
Enterprise actions may require approval, OAuth consent, missing information, or long-running fulfillment. The EmpowerID MCP Bridge maps supported orchestration states into MCP Tasks and Elicitation for compatible clients.
MCP Tasks remain experimental in the November 2025 specification. EmpowerID negotiates client capabilities and uses progressive compatibility rather than assuming uniform client support.
Keep credentials outside agent context
Vault-backed outbound authentication for registered servers and connectors. The agent receives authority to request the action—not possession of downstream secrets injected at the protected boundary.
- Vault-backed outbound authentication for registered MCP servers and enterprise connectors
- Delegated OAuth modes that retain tokens at the gateway—not in prompts, memory, or agent payloads
- Optional sender-constrained tokens where deployment configuration supports them
- Hashing or redaction of sensitive parameters in evidence rather than copying raw payloads
The agent receives authority to request the action—not possession of downstream secrets injected at the protected boundary.
Three-zone custody model: agent context, gateway boundary, downstream systems.
Operate MCP as an enterprise fleet
- Service and tool registration with stable authorization-operation binding
- OAuth protected-resource and authorization-server discovery
- Vault-backed secret handling without exposing secrets to agents
- Virtual MCP server composition for delegation-scoped discovery
- Connector and external MCP routing from one governed catalog
- Service, tool, decision, and receipt observability for security teams
- Policy simulation and staged enablement for new tools and agent populations
- Delegation revocation and cache invalidation aligned to configured contracts
Part of the EmpowerID Identity Fabric
| Fabric service | Role on the path |
|---|---|
| Identity Provider and credentials | Authenticate principals, issue tokens, support identity chaining and credential journeys |
| Governed Authorization | PDP evaluation through AuthZEN-compatible interfaces |
| Identity graph and membership | Agent, user, delegation, tool, and organization relationships |
| Orchestration & Fulfillment | Enterprise connector execution and durable workflows |
| MCP Gateway | MCP PEP at discovery and invocation; credential protection and routing |
| LLM Gateway | Model PEP—classification, budget, provider credentials, and allow-path receipts |
| Agent Governance & Execution | Broader agent controls beyond tool boundary—including governed execution where required |
Use cases
IT and security operations agents
Bounded administrative actions tied to a delegating engineer, current policy, and a governed tool definition.
Identity administration agents
Access-request and lifecycle operations without unrestricted admin credentials or unfiltered identity tool catalogs.
SaaS automation on behalf of users
Protected per-user OAuth credentials for supported SaaS platforms while keeping tokens outside agent-visible context.
Multi-server MCP environments
Register internal and third-party MCP services and publish different governed catalog views per agent population.
Regulated and high-consequence workflows
Stronger delegation, schema, plan, parameter, and evidence controls for money, access, regulated data, or infrastructure changes.
Standards-aligned by design
| Standard or protocol | How it is used |
|---|---|
| Model Context Protocol | Tool discovery and invocation; capability negotiation; Elicitation and supported Task patterns |
| OpenID Authorization API / AuthZEN | PEP-to-PDP communication for governed MCP decisions |
| OAuth 2.0 (RFC 9728, 8693, 9449) | Protected resource metadata, token exchange, and optional sender-constrained tokens where configured |
| JSON Web Signature (RFC 7515) | Signed schema, plan, and receipt artifacts on configured paths |
| OpenID Shared Signals (SSF) / CAEP | Continuous access and risk signals where deployed—interpreted by policy, not treated as commands |
| Identity Assurance (ID-JAG) / Cross-App Access patterns | Agent and delegated identity context at the gateway alongside per-tool authorization |
What MCP Gateway does not claim to solve
Credible agent security requires defense in depth. MCP Gateway focuses on identity, authorization, tool integrity, credential, and evidence controls at the tool boundary.
- Not a model-alignment or jailbreak-prevention system
- Not a guarantee that third-party tools contain no vulnerability
- Not a replacement for secure development, DLP, endpoint, or network controls
- Not an LLM routing, inference-cost, or token-budget gateway
- Not a guarantee of downstream business effect without trustworthy downstream evidence
- Not a complete implementation of every MCP primitive or client extension
Broader agent runtime controls live in Agent Governance & Execution.
Feature availability—including schema pinning, plan contracts, Task/Elicitation support, outbound credential modes, receipt coverage, and client transports—varies by edition, deployment, and release. Confirm scope with EmpowerID before customer-specific commitments. Packaging as a standalone Fabric service versus inclusion with Agent Governance requires commercial confirmation.
FAQs
Make MCP connectivity answer to enterprise authority
See how EmpowerID MCP Gateway connects agent identity, delegated authority, fine-grained policy, protected credentials, and correlated evidence at the tool boundary.
