INS-0008 · MCP value-and-authority map

MCP connects systems. Authority is designed separately.

The protocol makes resources, prompts and tools discoverable and invocable. The business system must still decide identity, limits, approvals, evidence and revocation.

Connection plane · what MCP standardizes

  1. 01 · RequestUser

    States an objective inside the application context.

  2. 02 · Experience and policyHost

    Orchestrates the model, interface and rules.

    Dedicated connectorMCP client
  3. 03 · Exposed capabilitiesMCP server

    Describes and provides bounded capabilities.

  4. 04 · Operational systemAPI · data · tool

    Executes or returns a result in the business system.

MCPResourcesPromptsToolsdiscovery and invocation, not authority
The host ownsUser experience, policy, selection and confirmation.
The server ownsExposed capabilities and the upstream connection.
Application and security layers enforcePermissions, approvals, credentials, audit and revocation.
Influence toward the model →Untrusted data, prompts or tool descriptions can steer model behaviour.
← Effect toward systemsExcessive credentials can amplify a mistaken or manipulated action.

Control rail · what must be designed separately

  1. 01Connection value

    Which real reuse case justifies MCP?

  2. 02Discovery surface

    What can appear, and who can change it?

  3. 03Identity and credentials

    Who acts, and which secrets cross the boundary?

  4. 04Effective authority

    What can it read, change, send or delete?

  5. 05Approval and execution

    Where can an action be confirmed, denied or escalated?

  6. 06Evidence and revocation

    What is recorded, and how is it disabled?

Non-negotiable boundary: MCP standardizes connectivity, discovery and invocation. It does not decide autonomy, business authority, permissions, approval, credential handling, auditability or revocation.

Specification checked: 2026-07-28 · M4TIC editorial synthesis, not a protocol standard.