Authentication, authorization, and permissions
Words made simple
A few useful meanings before you read the explanation.
- Authentication
- Checking who a user or service is, such as by verifying a login session.
- Authorization
- Checking what that identity is allowed to read or do. Being logged in does not grant access to every record.
- API
- A way for one piece of software to ask another for data or an action. A claims API might return the current status of a claim.
More words from this lesson
- Token
- A small piece of text processed by a model. It may be a whole word, part of a word, or punctuation.
- Tenant
- A customer or organization whose data must stay separate from other customers in a shared application.
- MCP
- A shared protocol for connecting AI applications to tools and resources. It does not replace permission checks or application security.
- HTTP
- The request-and-response protocol used on the web. HTTPS adds encryption to protect information in transit.
Overview
- Authentication establishes who a client/user is; authorization determines what that identity may do.
- MCP connection authorization and downstream business authorization are separate concerns.
- A valid connection does not automatically permit every customer's data or every tool action.
Why this matters
Shared servers could otherwise expose private records or execute writes on behalf of the wrong user.
An everyday example
A building pass permits entry; it does not permit opening every employee's filing cabinet.
A technical example
Validate a token's issuer, audience, expiry, and permitted scopes, then verify ownership of the requested claim.
How it works
- Authenticate request
- Establish trusted principal
- Filter capability exposure where appropriate
- Authorize each object/action
- Call downstream service with controlled credentials
- Audit.
Architecture and flow
Client credential → authenticated principal → tool + object authorization → downstream service.
The insurance assistant example
Customer A may look up A's claim, even if the model supplies customer B's identifier.
When to use it
Every remote/private MCP server and all sensitive operations.
When to avoid it
Never accept tenantId, role, or isAdmin in model arguments as authority.
Interview answer
“MCP authentication identifies the caller; the tool server still performs tenant, object, and action authorization for each call.”
Benefits, trade-offs, and production considerations
- Follow the negotiated protocol version's authorization guidance.
- Do not blindly forward inbound tokens to unrelated downstream APIs; prevent confused-deputy behavior, where a powerful server acts for a caller who lacks permission.
- MCP authorization, security guidance.
Can you explain it without the notes?
Authentication, authorization, and permissions
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Authentication establishes who a client/user is; authorization determines what that identity may do. MCP connection authorization and downstream business authorization are separate concerns. A valid connection does not automatically permit every customer's…
Turn this concept into a clear answer.
Practice this conceptAdapted from 13_AI.MD · “Authentication, authorization, and permissions”. Examples are study fragments; framework behavior can depend on your version.