Consent and Least Privilege
A tool call that changes something in the world should not run just because a model decided to call it. It should run because a human said yes to that specific call, and the client should hold no more access than that call actually needs. Explain why MCP has no server-to-client push for approvals, and how a multi round-trip request (MRTR) elicitation carries a consent question instead. Distinguish per-tool consent scoping from a blanket "trust this server" grant, and explain why a tool's annotations inform that decision without being allowed to enforce it. Read an HTTP 403 insufficientscope challenge and compute the scope a client should request next, as the union of what it already held and what the challenge demands. Apply a retry cap to a step-up authorization loop so a client with no path to the needed scope fails loudly instead of retrying forever. Explain why a result like tools/list can vary by the caller's granted scopes without ever varying for the same caller on the same request twice. An agent with tool access can do things a person cannot easily undo: delete a file, send a payment, message a customer, revoke an account. The tool that does any of that runs on a server the client did not write, driven by a model choosing when to call…
Consent and Least Privilege: A tool call that changes something in the world should not run just because a model decided to call it. It should run because a…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.