Your organization runs an MCP server that exposes 40 tools covering file operations, database queries, email sending, and external API calls. A Copilot agent is designed only to query internal databases and format reports. During a security review, it's discovered the agent can call the email-sending and external API tools without restriction. What is the primary security control that should be implemented?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A system prompt telling an agent 'don't use those tools' is like putting a 'Do Not Enter' sign on an unlocked door—a determined attacker (or a confused model) walks right through. Server-side allow-lists enforce the restriction at the infrastructure layer, where it cannot be overridden by a clever prompt.
Full explanation below image
Full Explanation
The fundamental principle here is that security controls must be enforced at the boundary layer they are intended to protect. System prompt instructions (Option A) are model-level guidance, but they can be overridden by prompt injection attacks, forgotten under complex conversation contexts, or simply ignored if the model misinterprets them. They are not a security control.
A server-side allow-list means the MCP server itself checks the agent's session identity against a permitted tool list before executing any tool call. If the tool is not on the list, the server returns an authorization error regardless of what the agent requests. This enforcement happens at the infrastructure layer and cannot be bypassed by manipulating the agent's context.
Implementation: the MCP server should associate each agent session (identified by its OAuth token or session credential) with a specific tool permission set. For this agent: allow db_query, db_list_tables, report_format; deny everything else.
Option C (post-hoc logging) is a detection control, not a prevention control—it catches misuse after the damage is done. Option D (renaming tools) is security through obscurity, which is not a recognized security control: the model can still discover tools through enumeration, and the obfuscation provides no protection if the tool list is exposed.
Allow-lists are the defense-in-depth complement to least-privilege token scoping: even if a token is compromised, the allow-list limits what tools can be called.