Every MCP integration works in the demo. The trouble starts the day an agent reads something it shouldn’t trust. A resume arrives with a hidden instruction buried in the text, the agent dutifully reaches for its database tool, and the only thing standing between your salary table and an external endpoint is a long-lived API key with admin rights that nobody remembers issuing. In this week’s newsletter, we cover the half of MCP adoption the launch posts skip. The Model Context Protocol killed the N × M connector nightmare, but its authorization framework is optional, and nothing in the protocol forces you to switch it on, scope it tightly or put a policy check in front of a tool. That gap is not a model failure. It is an architecture one, and it is exactly where agentic pilots quietly turn into incident reports. Here are 3 guardrails that close it: - 🔑 Delegated OAuth, done right: Learn why static keys should be retired on remote MCP servers, and why “just forward the user’s token” is the one shortcut the spec explicitly forbids. You’ll also see how token exchange gives every downstream call its own user-scoped credential. - ⚖️ A policy-as-code gateway: Discover how a Policy Decision Point running AWS Cedar or OPA checks every JSON-RPC request against hard constraints before a tool ever executes. It also explains why Cedar’s formally verified semantics and microsecond evaluation make that check effectively free. - 🚧 Egress, approvals and audit: See why identity alone won’t stop a prompt injection, and how locking down outbound tools, gating high-impact actions behind a human, and logging every tool call as a privileged event turn a breach into a blocked request. It closes with a practical checklist for data and security engineers. It also points to two resources that go deeper on the foundations underneath: the Scalefree expert session on getting your data platform ready for agentic AI, and Ignition’s article on why your AI is only as trustworthy as your data.