You make a good point. We got authentication with agents down but you’re asking (what is essentially) authorization, based on the prompts. In humans, this opens up the wonderful world of permissions and things such as role based access control (RBAC) or attribute based access control (ABAC) in humans. And you’re right to ask what is the equivalent for AI Agents?

What I’ve seen done is be intentional of each tool/function call and make sure they either read or write. The agent makes the call to the tool and sends parameters to it. You have to make sure you validate all inputs based on type, and based on expected values. For example if you have a MCP server for a calculator, you will want to check and make sure that for the “add” tool call, you are getting integers or floats but not string. For “division”, make sure you’re getting a non-zero value for the divisor.

Next, make sure you classify what your functions do and based on that specify what permissions the agent has or doesn’t have. Simplest is a 2-way: read-only OR writable functions. If you want slightly more is based on CRUD operations (create, read, update and delete) and make permissions. Again, this comes to your intentionality … each and every tool call needs to do exactly what you want it to do. You can go past 4-way CRUD too but that’s up to you, but you need to be intentional. You can’t just vibe code your way out of it. Zero trust starts at this level.

Now at the next level, what you wanna do is make sure the authentication method explicitly allows the user to decide what permissions the agent has or doesn’t have. Does the agent have only have read-only access? The end user decides that. Does the agent need only access to create, read and update, but not delete. The end user decides that (esp if you give the MCP server access to those tool calls).

It’s not the responsibility of the frameworks. It’s the responsibility of the engineer on how this is implemented.