Your organization runs an MCP server that exposes 40 tools covering file operations, database queries, email sending, and external API calls. A Copilot agent is designed only to query internal databases and format reports. During a security review, it's discovered the agent can call the email-sending and external API tools without restriction. What is the primary security control that should be implemented?
Select an answer to reveal the explanation.
Short Explanation
System prompt telling an agent 'don't use those tools' is like putting a 'Do Not Enter' sign on an unlocked door—a determined attacker or confused model walks right through. You need the MCP server to enforce a session allow-list so the agent can only call database-query and report-format tools, and every other tool call is denied before it runs.
Full Explanation
The fundamental principle here is that security controls must be enforced at the boundary layer they are intended to protect. The system-prompt approach, instructing the agent not to use email or external API tools, is model-level guidance, but it can be overridden by prompt injection attacks, forgotten under complex conversation contexts, or simply ignored if the model misinterprets it. It is not a security control.
The correct control is the server-side allow-list that restricts this agent's session to only the specific tools it requires for database queries and report formatting. This means the MCP server itself checks the agent's session identity against a permitted tool list before executing any tool call. If the tool is not on the list, the server returns an authorization error regardless of what the agent requests. This enforcement happens at the infrastructure layer and cannot be bypassed by manipulating the agent's context.
Implementation: the MCP server should associate each agent session, identified by its OAuth token or session credential, with a specific tool permission set. For this agent, allow db_query, db_list_tables, and report_format; deny everything else.
Logging all tool calls so security can review them after the fact and alert on misuse is a detection control, not a prevention control—it catches misuse after the damage is done. Renaming the email and external API tools to obscure names so the agent is less likely to discover them is security through obscurity, which is not a recognized security control: the model can still discover tools through enumeration, and the obfuscation provides no protection if the tool list is exposed.
Allow-lists are the defense-in-depth complement to least-privilege token scoping: even if a token is compromised, the allow-list limits what tools can be called.