July 2026 Summaries

On July 28, 2026, a significant update to the Model Context Protocol (MCP) specification introduced enhanced security measures and operational efficiencies, including stateless request handling and improved load balancing, but also highlighted the limitations of OAuth in runtime authorization. While OAuth remains crucial for delegated access and identity management, it does not address the specific authorization needs for high-risk operations, necessitating policy enforcement mechanisms beyond OAuth scopes. The update emphasized tighter credential binding through RFC 9207 issuer validation and deprecated Dynamic Client Registration in favor of Client ID Metadata Documents for better registration clarity. The introduction of Mcp-Method and Mcp-Name headers allows for efficient request classification and policy decision-making, enhancing security and audit capabilities. Permit, as a runtime authorization layer, offers a way to externalize policy decisions, maintaining a separation between identity management and action governance. This architecture aligns with enterprise federation patterns, providing a structured approach to authorizing tool calls, which is critical for managing risk in high-impact environments.

AI incident response governance emphasizes a structured approach where read-only diagnostics and remediation tools are distinctly separated by trust levels to minimize risks associated with autonomous changes in production environments. The process involves a lifecycle for ops agents that includes querying, correlating data, hypothesizing, validating, and recommending before remediation, with most incidents concluding at the recommendation stage unless higher trust policies are in place. Trust is classified by operation risk, not subjective assessments, ensuring that tasks like reading logs are low-risk while actions like changing infrastructure require stringent controls. The enforcement model assesses each tool call by agent identity, intent, and environment to determine trust ceilings, with higher-risk operations necessitating explicit approval and detailed audit trails for accountability. This framework, supported by tools like Permit, allows enterprises to implement scalable, defensible control planes across platforms such as Azure, Microsoft Graph, GitHub, and Kubernetes, ensuring that AI ops agents operate within clearly defined boundaries and under human-in-the-loop supervision where necessary.

In the evolving landscape of agent-generated APIs, governance becomes crucial to manage both the speed and risks associated with machine-generated OpenAPI specifications. While autonomous agents can handle some inconsistencies, they often transform issues like spec drift and ambiguous metadata into runtime failures, necessitating a comprehensive governance approach. Effective solutions require a connected control loop that spans from design-time governance through to runtime authorization, ensuring that APIs adhere to naming, versioning, and error-handling standards. As the Postman analysis suggests, successful governance programs embed enforcement where work occurs, such as during authoring and continuous integration, rather than relying on periodic audits. This approach is particularly important for agent-callable tools, where both API production and consumption are increasingly automated. The piece outlines a rigorous governance pipeline, emphasizing the need for real-time governance controls, constrained execution credentials, and audit receipts to ensure accountability. Additionally, it underscores the importance of separating identity proof from action control in multi-agent systems to maintain security and operational integrity.

AI-generated authorization policies present a complex challenge, as they can appear coherent yet be fundamentally incorrect due to semantic, rather than syntactic, discrepancies. This issue is exacerbated in AI-heavy ecosystems where policy generation is intertwined with planning, tool use, and delegation, potentially leading to inappropriate access under realistic conditions. The key to safe AI-generated policy lies in explicitly modeling intent, human-reviewed boundaries, and verifier-constrained synthesis, ensuring live context guides runtime decisions. Practical approaches involve decomposing requirements into testable intent atoms, validating schemas and boundaries, and employing verifier-guided policy synthesis, as demonstrated by AutoCedar. Runtime enforcement requires a Protocol Data Processing (PDP) layer, such as Permit, to evaluate dynamic factors like agent identity and tool arguments, ensuring that decisions made in production align with the verified policy model. Comprehensive testing, staged deployments, and robust audits are essential to maintain policy integrity and compliance, making AI-assisted policy engineering a collaborative and accountable endeavor.

Recent incidents involving Model Context Protocol (MCP) highlight the critical need for runtime authorization beyond initial authentication to prevent unauthorized tool access and potential misuse. These issues underscore the dangers of relying solely on identity verification at the periphery, as demonstrated by two incidents: fast-mcp-telegram's token handling vulnerability allowing path traversal and LiteLLM's exploit involving test routes leading to remote code execution. The core problem lies in the conflation of authentication, which verifies identity, and authorization, which determines access rights to specific actions and resources. Effective security requires a fail-closed authorization model that classifies routes into different risk tiers, enforces per-call runtime checks, and logs both allow and deny outcomes for comprehensive auditability. An MCP Gateway can centralize policy enforcement, ensuring that each tool execution decision is based on current context and policy, thus closing the gap left by traditional perimeter security and enhancing overall system reliability.

In enterprise systems, it is crucial to distinguish between payment proof and authorization proof for executing paid MCP tool calls, as conflating the two can lead to security vulnerabilities. Payment events, such as those signaled by HTTP 402 Payment Required, merely indicate financial transactions, not the authorization for a specific action. Proper management involves treating payment, identity, consent, and authorization as separate proofs, each with distinct lifecycles and verification processes. This separation is vital for ensuring that tool calls proceed only when all proofs align, preventing unauthorized actions even if a payment has been made. The policy decision should be contextual, considering factors like agent identity, purpose, and risk, rather than relying on static entitlements. Trust-tiered policies can allow for automatic spending under certain conditions, but higher-risk actions should require additional consent measures. Modern payment signaling standards, such as the x402 pattern, facilitate payment verification but must be complemented by runtime authorization to maintain security and governance. Comprehensive audit logs are essential for tracking the lifecycle of tool calls, aiding in finance reconciliation and policy tuning. Permit.io can serve as the runtime authorization control plane, ensuring that paid actions are controlled and aligned with policy decisions, rather than simply enabling payments.

Enterprise Resource Planning (ERP) systems are evolving to incorporate AI agents that autonomously execute multi-step workflows across various domains like finance, HR, procurement, and payroll, necessitating a shift in the security paradigm. Traditional ERP security, focused on static user roles and transaction codes, is being replaced by a Model Context Protocol (MCP) that requires dynamic, contextual, and delegated authorization at runtime. This approach ensures each tool call is evaluated based on identity, workflow stage, and business risk, thereby strengthening governance and minimizing risks associated with autonomous actions. Vendors such as SAP and Microsoft are aligning their offerings with these principles, emphasizing the importance of runtime authorization that goes beyond OAuth scopes to provide fine-grained control over agent actions. The architecture now necessitates a product-agnostic framework that supports consistent and auditable policy enforcement across diverse ERP tools, with solutions like the Permit MCP Gateway offering centralized control and decision-making capabilities. This shift aims to operationalize least privilege for AI agents, ensuring that only necessary permissions are granted, thereby enhancing security and accountability in ERP AI governance.