Identity
Know the user, client, server and delegated authority.
AGENTS + MCP
Connect systems.
Keep control.
MCP is a powerful connection layer. Reliable agent systems still need identity, authorization, verification, observability, human approval and recovery.
REVIEWED SEP 06, 2026PRACTITIONER-LED
PROTOCOLMCP
AGENT
TOOLS
DATA
IDENTITY
POLICY
AUDIT
CURRENT SPECIFICATION
2026-07-28 changes the production model.
The current MCP release uses a stateless core, adds routable headers, cacheable list results, authorization hardening, extensions and formal deprecation handling.
Official release notes ↗STATELESS COREScale behind ordinary HTTP infrastructureAUTHORIZATIONHarden issuer and client metadata handlingEXTENSIONSTasks, Apps and enterprise authorization evolve independentlyDEPRECATIONPlan migrations rather than react to breakage
MCP IN THE SYSTEM
Tool discovery is not authorization.
Permissions
Expose the minimum capability required for the task.
Observability
Trace discovery, calls, arguments, results and failures.
Verification
Confirm side effects independently of model confidence.
Recovery
Support revocation, rollback, retries and escalation.
Human control
Approval remains explicit for consequential actions.