3.2 — Authentication, Authorisation, and the Gaps Between

CCAR-P Domain 3 · Task 3.2

What You Need to Know

Authentication = who is calling. Authorisation = what may they do. A security gap exists wherever effective privilege exceeds the requesting user’s legitimate need.

The Confused Deputy

Agent serves many users through one over-privileged service account → any user can potentially reach anything the account can.

Fix: identity propagation — tool calls carry the authenticated user’s identity; every read/write is scoped to what that user may reach.

Secrets Never Meet the Model

Prompts are logged, cached, and can be echoed. Credentials in model-visible context are published. Secrets belong in a secrets manager, injected at the tool boundary. After a leak: rotate first, then move the privileged call behind a backend the client cannot bypass.

Token Passthrough Is Forbidden

MCP explicitly forbids accepting a client’s token and forwarding it downstream. Harms: breaks audience validation, destroys attribution, circumvents rate limits, lets stolen tokens travel. Each hop authenticates for itself with its own scoped credential.

Attribution Is Architecture

Every tool invocation should land in the audit trail with user attribution (who asked, which tool, which resource). Shared API keys across users/environments = no attribution + maximum blast radius.

Key Concept: Trace the whole chain. Effective privilege is measured at every hop.

Exam Traps

• Adding MFA/SSO when the gap is over-broad scope or shared credential
• Logging all agent calls as the fix for a structural privilege problem
• Forwarding the user’s token downstream “to keep the design simple”
• Securing the client-to-agent link when the gap sits at the agent-to-downstream hop