MCP authentication: distinguish user identity from service identity

An MCP server may authenticate as a service to a downstream system while acting for a user. Those identities and permissions are related but not interchangeable.

Inspect the identity context

The MCP contract lab creates an authored context.

from mcp_cases import identity_case

result = identity_case()
assert result["identities_distinct"] is True
assert result["user_scope_forwarded_as_service_scope"] is False
assert result["delegation_bounded"] is True
print(result["context"])

User U-7 belongs to tenant T-1 with metrics:read; the service has warehouse:query; delegation is audience-bound to one tool with expiry. No identity provider runs.

Authenticate and authorize separately

Authentication establishes who/what presented a credential. Authorization decides whether that actor may invoke the tool on this resource. Preserve user/tenant context while using service credentials only for permitted backend access.

Use audience, scope, expiry and tool/resource constraints on delegated credentials. Never treat a model, prompt or retrieved document as an identity. Avoid logging raw tokens.

Test confused-deputy paths

Try cross-tenant IDs, broader service scopes, expired delegation, wrong audience and calls without user context. Deny before data access and audit actor plus service separately.

The Generative & Agentic AI course links MCP identity to least privilege, token exchange and tenant isolation.

Exercise

Draw the identity/authority chain for one integration. Implement five denial tests and prove service privilege cannot expand the user’s permitted scope.

Continue learning

This article is part of the MCP and integration contracts sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Validate tool output before showing it to a model.
• Continue with Apply least privilege to an AI tool catalogue.

Reference: MCP authorization specification.