Integration Protocols, Identity, and Least Privilege
A tool is not safe because Claude uses it carefully. It is safe when the system refuses unauthorized use. Choose direct API, CLI, MCP, or agent-to-agent integration from requirements. Separate capability discovery from execution authorization. Design least-privilege tool sets and identity propagation. Return structured, actionable errors without leaking secrets. Place approval, audit, and revocation controls at the execution boundary. A support agent can read tickets, draft replies, issue refunds, and delete user accounts. Most support staff only need the first two capabilities. The team keeps all four tools enabled and adds a prompt: "Never issue refunds or delete accounts unless absolutely necessary." This is not least privilege. The dangerous capability still exists, the model still sees it, and prompt injection can still target it. Confirmation text can reduce accidental use, but it cannot replace authorization. The structural fix is smaller: do not expose capabilities the role does not need, propagate the caller's identity, and enforce scope plus approval when a tool executes. The protocols overlap, but they solve different primary problems. MCP does not replace every API. A stable internal service call may be clearer and faster as a direct API. MCP earns its place when several hosts need a common way to discover and call capabilities, or when tool ownership should remain behind a server boundary. A CLI is…
Integration Protocols, Identity, and Least Privilege: A tool is not safe because Claude uses it carefully. It is safe when the system refuses unauthorized use.
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.