Give a program access to a credential, and you have given it everything that credential can do. Give an agent access to a filesystem, and you have potentially given it access to every secret, source tree, configuration file, and credential reachable through that filesystem. Give an MCP server a cloud credential, and a compromise of that server can turn a narrowly intended integration into a much broader security incident.
The conventional response is to put more policy around the environment: firewalls, sandboxing, identity, secrets managers, admission controls, network policy, prompt inspection, and increasingly elaborate allowlists. These controls are useful. But they often start from the assumption that a workload already has authority and then attempt to constrain its use.
