VOCE Agent Conformance · MCP-02

Tool-level authorization

Are MCP tools authorized individually rather than inherited as an undifferentiated server capability?

MCP governanceA1+CriticalPermanent control URL
Normative wording

MCP-02 · Tool-level authorization

Are MCP tools authorized individually rather than inherited as an undifferentiated server capability?

DomainMCP governance
Expected ownerIAM / Security
Minimum maturityA1+
CriticalityCritical
Target evidence stateTested
Expected evidence

Expected evidence

  • Tool policy
  • Allow/deny test
  • Permission matrix
Method

How to read this control.

This control belongs to VOCE Agent Conformance. Its identifier and normative wording remain identical across language versions so there is one reference, not three variants. Status depends on dated evidence, not a vendor declaration or aggregate score.

Open Agent Conformance →