Keeping MCP access safe and governed

2:00 min

Expert

Connecting an agent to your data doesn't remove the need for access control — the agent should act with the same permissions and tenant scope as the user it represents. This article is a review checklist for teams evaluating or adopting an MCP integration; for implementation details, see the developer documentation linked below.

In this article, you will learn:

Why tenant-aware scoping matters more with agents than with typical application code
What to check before connecting a customer-facing agent to Luzmo
A worked example of what can go wrong without proper scoping

Example: why identical questions need different answers

Consider two regional managers using the same agent. The EMEA manager asks, "Which customers are below target?" The North America manager asks the identical question. The prompt is the same, but the result must not be — each manager should only see their own region's customers.

Each MCP request must carry the authenticated user's data scope so Luzmo only evaluates the customers that person may access. The model should never receive every tenant's result and be asked to remove unauthorized rows itself afterward — filtering after the fact is not a substitute for enforcing access before the query runs.

Before connecting a customer-facing agent, confirm:

The user authenticates through your application — not through a shared or generic credential
User and tenant context is applied before a query runs, not filtered out of the result afterward
The agent can only access approved datasets and capabilities
Sensitive or unsupported requests are refused safely, rather than answered speculatively
Tool calls and resulting actions can be audited after the fact
End users are never given your Luzmo API credentials directly

The core rule

Do not connect a customer-facing agent with a broad service account and rely on the model to filter the result afterward. Data access must be enforced by the application and analytics layer — not by prompting the model to behave.

This is the same governance discipline you'd apply to any embedded, multi-tenant integration; MCP doesn't relax it, and an agent's ability to phrase a clever question doesn't grant it access it wouldn't otherwise have.