MCP made tool access easy and left the authority model to whoever wires it up. In practice that means a bearer token, held by a server, used on behalf of whichever agent asked — with no record of how many hops the request has already traveled or what scope the original principal actually consented to.
This is the confused deputy problem, and MCP's architecture makes it structural rather than incidental. The server holds credentials. The agent supplies intent. Neither can verify the other's authority. When one agent calls a tool that invokes another agent that calls a second tool, authority does not narrow across that chain — it persists at whatever scope the token was minted with, and any hop can spend it.
The talk covers three things. Where the trust boundary actually sits in current tool-calling protocols versus where implementers assume it sits. A threat model for multi-hop chains: scope escalation, cross-server confused deputy, replay across sessions, and the service-account collapse pattern where agents share one high-privilege identity because per-agent identity is operationally painful. Then what the field is reaching for — scoped token exchange (RFC 8693), macaroons, and capability tokens such as biscuit-auth — assessed on what each cryptographically guarantees versus what it merely encourages, plus why capability models fight with the centralized revocation and audit reconstruction that enterprises already depend on.
Grounded in a systematic review of the delegation and authorization literature conducted for my doctoral research, and in enterprise access-control and data governance work in regulated financial services.
Scope, stated plainly for the committee: this is architecture and threat modeling, not a 0-day or a tool release. If you already have MCP offensive work on the program, this complements it as the authority-layer view rather than duplicating it. I'd also be glad to bring it as a lightning or short-format slot, or to sit on or moderate a panel on agent identity and delegation if that fits the agenda better.
About the Presenter: Yashvardhan Rathi
Yashvardhan Rathi is an AI & Data Consultant at Truist Bank, where he leads enterprise data scanning and classification across hybrid cloud at 1,000+ data source scale under SOC 2, NIST 800-53, and FFIEC. He holds two pending U.S. patents in cloud resilience architecture, both running in production. He is a Ph.D. candidate at the University of the Cumberlands researching delegation and authorization in multi-hop AI agent chains, and reviews for Cluster Computing (Springer). He keynoted ICAEAS and the Atlanta Cloud Conference in 2025.
