Interception over cooperation
Asking agents to enforce policy themselves assumes every participant is well-behaved and current. Enforcing in the path between them makes the guarantee independent of the agent's implementation.
Governed agent and tool communication
Platform policies for Model Context Protocol and agent-to-agent communication: how agents find each other, prove who they are, and reach tools safely.
- Organisation
- Salesforce / MuleSoft
- Period
- 2025 – Present
- Area
- Agentic AI infrastructure
Context
An agent becomes useful when it can reach tools and other agents. That is also the point at which it becomes a security boundary: it acts on behalf of a user, against protected resources, with a degree of autonomy.
The problem
Communication between agents, MCP clients and servers, tools and enterprise services has to be governed without breaking the protocols it governs. Identity has to survive a hop, because the system needs to know both which user a request is for and which agent is acting on their behalf. Authorisation challenges, streaming transports and partial failures all have to be handled inside that same path.
Constraints
- Policy has to be transparent to the protocol; a governed channel must still behave like the protocol it implements.
- Both subject and actor identity must survive propagation across a hop.
- Streaming transports leave the exchange open, so enforcement cannot be a single decision at the start.
- Token handling sits on the boundary between two trust domains and must not widen either.
My contribution
Shared ownership stated as such. Nothing here claims sole authorship of a platform.
- Developed platform policies for governing Model Context Protocol communication between agents, tools and enterprise services.
- Worked on policies and infrastructure supporting secure, governed communication between autonomous agents: discovery, authentication, identity propagation and authorisation challenges, all routed through controlled gateways.
- Worked in the areas of delegated authorisation and context propagation associated with governed agent and tool access.
Approach
Enforce at the gateway instead of inside each agent, so a policy change does not require redeploying every participant and an agent cannot opt out of the controls that apply to it.
Keep actor and subject distinct throughout. Collapsing 'which agent is calling' into 'which user this is for' is convenient and makes delegated access impossible to audit afterwards.
Treat authorisation challenges as part of the normal flow. A governed channel has to be able to say what is missing and let the exchange continue, not simply fail closed and silent.
Decisions that mattered
The ones with a real cost on the other side.
Not owning the identity system
These policies consume delegated authorisation instead of reimplementing it. Keeping the boundary there avoids a second, divergent source of truth for identity.
Outcome
Policies that let enterprises put agents and tools into contact under the same access controls that govern the rest of their systems, with identity preserved across hops.
What generalises
- A security boundary should be enforced in the path, not delegated to the parties it constrains.
- Identity that cannot be attributed after the fact is not really identity.