Iron Brick Insights ·
The Model Context Protocol makes it easy to connect AI agents to agency systems. Here is how to keep that connection safe.
The Model Context Protocol (MCP) gives AI assistants a standard way to call tools: search a case system, read a document, draft a note. That convenience is exactly why it needs discipline. An MCP server is an API with an AI client, and everything we already know about securing APIs applies, plus a few rules specific to agents.
1. Authenticate every client, and act as the user
Every connection to an MCP server should present a token from the agency identity provider. The server should then act on behalf of the signed-in user, using token exchange or a similar pattern, so an assistant can never see more than the person using it.
2. Make tools narrow and read-only by default
Expose small, specific tools such as "get case status" rather than a general query tool. Start read-only. Any tool that writes should produce a draft that a person approves.
3. Authorize each tool call, not just the session
Check the user's rights on every call, against the specific record requested. Session-level access is not enough when an agent can make hundreds of calls in a minute.
4. Minimize and mask data
Return summaries before full records, and mask sensitive fields such as SSNs and dates of birth unless policy allows them. What the model never receives, it cannot leak.
5. Treat tool output as untrusted input
Text inside records can contain instructions aimed at the model (prompt injection). Keep tool results clearly separated from instructions, and never let retrieved content trigger write actions on its own.
6. Log everything to the SIEM
Record the user, the agent, the tool, the parameters, and the result of every call, and send it to the SOC. Add alerts for unusual patterns, such as one agent reading thousands of records.
7. Register every agent
Keep a registry: who owns each agent, which tools and scopes it has, how much it can do on its own, who reviews its work, and how it is evaluated. That registry also supports agency AI use-case inventories.
None of this slows a good program down. It is what lets security and privacy teams say yes. If you are planning an agent pilot, our Agent Governance Kit starts from these controls.