Chapter 2 of 6 · Architecture

MCP and tool security

Runtime assurance 3.5 hours in a non-production POC

Chapter 2 of 6

Architecture at a glance#

A Foundry agent and API Management use separate identities to reach a read-only backend.

The candidate agent gets a token for the MCP audience. APIM validates its tenant, client application, audience, and app role, then exposes only get_policy. APIM gets a second token for its system-assigned identity. The backend accepts that identity at the exact approved read scope.

The backend validates policyId. APIM records the tool, status, latency, W3C operation_Id, and client X-Correlation-ID. It records no arguments, results, prompts, responses, tokens, or bodies.

Design choices and tradeoffs#

DecisionChosen approachCost or limit
Tool surfaceOne get_policy toolAnother action needs review and deployment
Backend accessAPIM managed identity with the exact read role and scopeTwo audiences and role assignments need ownership
ReleaseTest an unpinned candidateEnablement waits for both checks
TelemetryCorrelation and tool metadata; zero body bytesContent investigations stay in governed source systems

Architecture guidance#

Session 08

MCP and tool security slide deck