AARM Framework Application to MCP Tool Authorization

MCP tool authorization needs more than a valid OAuth token. The AARM specification supplies a runtime-first framework for deciding whether an agent’s next action belongs within the user’s request, given everything that has already happened. Its central message is simple. Authorization must govern tool execution in context, before the action takes effect, and leave evidence of why it was permitted.

Why static OAuth cannot carry the full weight of MCP tool authorization

MCP lets agents query databases, send email, modify files, and invoke cloud services, often without human intervention. Yet systems in production may not enforce all that its OAuth 2.1 profile requires. OAuth handles delegated identity, while assessing whether a particular tool call and its parameters make sense requires context from the agent’s earlier actions.

That distinction explains why legitimate credentials do not settle MCP’s main security questions. A confused deputy attack uses inputs that an attacker has influenced to redirect a server’s ambient authority, without the attacker having to authenticate directly. Token passthrough sends upstream credentials to downstream systems they were never scoped to touch. Tool poisoning manipulates client behavior through malicious tool descriptions, while over-privileged credentials give a compromised agent room for lateral movement. Intent drift is subtler because individually authorized actions can combine into a prohibited outcome.

The July 28, 2026 MCP spec revision made the protocol core stateless, with authorization carried by each request. This hardens authentication but requires clients, gateways, and servers to carry cross-request context explicitly. Without that history, the protocol cannot recognize the fourth step in an exfiltration chain. The specific gap is understanding what an action means in context before it executes.

What AARM is and why it treats tool execution as the stable security boundary

Herman Errico’s Autonomous Action Runtime Management specification places the security boundary at tool execution. That boundary matters because an agent’s actions can be irreversible and its orchestration layer may be compromised. SIEM systems observe events after execution, while API gateways enforce identity and rate limits without evaluating the agent’s earlier access. Firewalls protect a perimeter that an agent with legitimate credentials already operates inside.

AARM therefore distinguishes actions by what is needed to authorize them. Forbidden actions are blocked whatever the context, including dropping a production database or transmitting to a known malicious domain. Context-dependent actions need checks that look at both what policy permits and what the session history shows. Deferrable actions have insufficient, ambiguous, or conflicting context, so suspension is the correct response.

The specification defines nine conformance requirements, with R1–R6 forming the core and R7–R9 the extended requirements. It proposes four implementation architectures that differ in what must be trusted and how they might be bypassed. The specification operationalizes this through five layers, each addressing a distinct failure mode in MCP deployments.

Layer 1: Pre-execution interception and why the intercept point determines everything downstream

AARM R1 requires that every tool call be intercepted before it runs. In MCP, that puts the control between the client’s invocation and the server’s execution, after OAuth has done its work. Every later layer depends on this placement. A call that bypasses interception also escapes the context-based decision that interception was meant to trigger. Covering most calls is therefore a weaker guarantee.

Architecture determines how strong that guarantee can be. A protocol gateway sits in the transport path but requires all traffic to pass through it. SDK instrumentation depends on adapter coverage and can be bypassed by direct invocation through malicious code or misconfiguration. Kernel eBPF provides syscall-level interception that covers the most calls and is the hardest to deploy, while vendor integration depends on how carefully the vendor implements it.

Microsoft’s Agent Governance Toolkit illustrates the no-bypass requirement through PolicyInterceptor, which intercepts calls across its supported framework adapters and combines SDK instrumentation with a protocol gateway. Its specification explicitly forbids bypass paths. This discipline matters especially for MCP’s dynamic tool discovery, where the available tools can change at runtime. Interception must cover the resulting invocation, including tools beyond those a static allowlist anticipated.

Layer 2: Session-context accumulation and the compositional risk OAuth cannot see

Intercepting a call creates a decision point, but it does not supply the history needed to decide. AARM R2 requires session context to build up as tool calls are made. That record includes the user’s original request, prior calls and parameters, data accessed, tool outputs, spend, and the delegation chain. Each new action is evaluated against that record.

An agent may legitimately have permission to query a database and send email. Those permissions alone do not reveal that it has just read customer PII and is now attempting external transmission. The risk arises from combining the capabilities in sequence.

MCP’s stateless design moves responsibility for preserving that sequence to the implementer. Correlation identifiers and logging must link the client, gateway, server, and downstream systems so the evaluator can use context from across requests. AGT’s ExecutionContext accumulates calls, outputs, spend, and delegation history, supporting cumulative policies such as rate limits and budget caps. With multi-agent delegation, that history must also pass from one agent to another. Otherwise, the downstream evaluator sees only a fragment of the run it is authorizing.

Layer 3: Policy-plus-intent evaluation and why static RBAC cannot classify context-dependent actions

Once history is available, the evaluator must use it to classify the proposed action. RBAC and ABAC checks against attributes such as role, resource type, and time of day do not by themselves provide this session-level reasoning. AARM R3 requires policy evaluation to check both the agent’s permission to use a tool and whether the invocation serves the user’s stated request.

Deleting database records shows why the distinction matters. It may be appropriate when the user asked to “clean up my test data” and the context supports that request. The same operation may be catastrophic lateral movement when the user asked for a report summary. A forbidden action needs no such contextual judgment, while conflicting evidence calls for deferral. Static permission cannot resolve all three cases.

AARM R7 adds semantic distance, which measures how far the current action has drifted from the original request. AGT grounds this approach in a Cedar policy backend that evaluates tool name, parameters, agent role, and session intent together. Its PromptDefense evaluator runs before policy evaluation to flag prompt injection, semantic drift, and goal misgeneralisation. This pairing addresses MCP tool poisoning at the relevant boundary. Even when OAuth validation succeeds, an action prompted by a malicious tool description may no longer serve the user’s goal.

Layer 4: The five authorization decisions and why DEFER matters more than DENY for agentic pipelines

AARM R4 mandates exactly five decisions, namely ALLOW, DENY, MODIFY, STEP_UP, and DEFER. ALLOW and DENY handle cases where policy and context yield a clear verdict. The other decisions address situations where execution needs a narrower scope, stronger assurance, or more information.

MODIFY rewrites tool-call parameters before execution rather than blocking an otherwise legitimate operation. A broad read request can become a scoped read, enforcing least privilege at the parameter level. STEP_UP instead halts execution for additional assurance, such as human approval. It maps to MCP’s step-up scope pattern, where the client computes the union of existing and newly required scopes. The runtime decision supplies the signal that re-authorization is needed before the next call proceeds.

DEFER suspends the action and preserves pipeline state until sufficient context or authorization arrives to decide whether the action should happen. OAuth and RBAC do not supply this pipeline-preserving decision. In those access checks, the request resolves to allow or deny rather than remaining a suspended action awaiting resolution.

That distinction matters when agents depend on one another’s results. A premature denial can disrupt a legitimate sequence, while a poorly handled suspension can leave downstream agents proceeding with stale or partial context. AARM requires that deferred actions keep high-risk operations from running before a decision is reached, either automatically or with human help. DEFER is therefore a controlled state.

Layer 5: Tamper-evident audit receipts and why post-hoc forensics cannot substitute for them

A decision based on accumulated context needs evidence that preserves its reasoning. AARM R5 requires tamper-evident receipts that record the action, context, decision, and outcome when the decision is enforced. A persistent log alone is insufficient because it may be changed after the event. The forensic requirement is to reconstruct both what happened and why each step was authorized.

MCP’s stateless architecture makes causal linkage explicit work. Receipts need correlation identifiers so investigators can trace events through an action chain instead of working from records with no links between them. AGT implements hash-chained audit records, with each entry hashing its predecessor using SHA-256, so alteration can be detected through offline verification. OpenTelemetry decision export supplies the telemetry layer. An audit-overflow circuit breaker denies rather than silently dropping records, preserving the connection between enforcement and evidence.

Identity binding under R6 makes that evidence attributable. Each receipt must connect the action to a verified agent identity and its delegation chain. AGT’s per-agent Ed25519 did:mesh identity illustrates that binding. Without it, the record establishes that something happened but not which agent was responsible. An audit trail that cannot prove what the agent did and why the policy allowed it is not an audit trail for regulatory purposes.

Where the AARM model holds and where it reaches its limits in MCP deployments

Interception coverage is not enforcement integrity. AARM controls tool invocation and the parameters passed to a tool, but it cannot stop bugs inside the tool or malicious behavior that ignores those parameters. Its guarantee stops at that boundary.

SDK bypass risk is a separate limit, and combining gateway and SDK architectures addresses that risk more directly than relying on instrumentation alone. Direct tool invocation through malicious code, bugs, or misconfiguration can evade an SDK layer. The specification consequently treats architecture as a trust decision. The strength of the claim must match the paths the deployment actually controls.

Standards immaturity also limits portability, which makes audit-format standardization necessary. MCP’s July 2026 authorization profile supplies an authentication foundation, but the ecosystem does not yet have a standardized audit trail format. A receipt that is offline-verifiable in one implementation may not work with the telemetry pipeline in another. These limits argue for combined architectures and standardization.

What a conformant AARM implementation looks like when applied to an MCP deployment

AGT satisfies all nine AARM requirements and qualifies for AARM Extended as of June 14, 2026. It is used in production at Microsoft, with adopters including Dayos and Provedit. Interception, context, evaluation, enforcement, and evidence form one authorization path.

In an MCP deployment, that path begins with PolicyInterceptor and continues through ExecutionContext into joint policy-and-intent evaluation. That decision must control how the tool runs, with changes to parameters, more assurance, or suspension when needed. Merkle-chained receipts and telemetry export then preserve the enforcement record. Verified agent identities make that record attributable, while the MCP Security Gateway issues ephemeral, least-privilege credentials scoped per invocation.

Authentication remains the foundation beneath that runtime path. The Enterprise-Managed Authorization extension became stable on June 18, 2026, and VS Code 1.123 implements it through admin-configured IdP policy. EMA handles provisioning. It therefore complements AARM. A conformant deployment connects authenticated access to contextual control over the action itself, with evidence that the connection held.