Zero Trust was built for human and service identity. Autonomous agents need Least Agency. This is a doctrine, not a product. MCP Visor is an open-source proof of the enforcement point the doctrine requires.
Agents read files, call tools, create tickets, run code, and send messages. In that world the unit of risk is the tool call, not the login. A valid credential can still cause harm — by injection, by a misread tool description, or by chaining allowed functions into an unsafe outcome.
Never trust identity. Always verify access.
OAuth, JWT, and RBAC can prove which integration is calling. They do not prove whether the action is safe in the current agentic context.
Never trust autonomous intent. Always verify action authority at execution time.
Agents should not carry broad ambient authority. Every action should be narrow, contextual, revocable, and auditable at execution time.
The agent, session, user, or delegated workflow.
The tool method or operation being requested.
The resource, parameter, record, or endpoint.
Arguments, rate, time, approval, classification, source.
Request context, prior actions, and policy state.
The grant ends when the task ends. Authority does not linger.
Model-based guardrails can classify prompts and summarize risk. They should not be the final enforcement boundary for high-impact actions. Models are probabilistic. They can be influenced by the input they are asked to police. They can fail silently. They cannot provide a strong denial guarantee.
A deterministic enforcement point does not ask whether the agent sounds safe. It asks whether the request matches policy — and it can deny because the tool, target, sequence, or approval is wrong, then log the exact request and decision.
The Model Context Protocol standardizes how agents invoke tools. If that traffic passes through a controlled proxy, policy can be evaluated before the tool server executes the request. Placement is the point: if enforcement happens after the tool has executed, it becomes monitoring. Monitoring does not prevent harm.
What stays open: the proxy, the policy evaluation path, the local audit log, extension points, and the test suite for bypasses. A fleet control plane is a later, pull-based possibility — not a current claim, and not a substitute for an inspectable enforcement core.