Protect both identity and the data returned by tools.
1. Scoped credentials
Use the authorization flow appropriate to the selected transport and server. Validate token audience and scope and keep tokens out of prompts, logs and tool results.
2. Per-user checks
A backend must authorize each operation for the current user. Connection-level authentication does not establish access to every record a tool can query.
3. Untrusted tool output
Retrieved documents and tool descriptions may contain hostile instructions. Treat them as data and prohibit them from changing server selection, permissions or credential destinations.
Worked scenario
A retrieved page asks the agent to send its access token to a URL. The host must refuse the action regardless of the page’s wording.
Apply it
Test forged record IDs, expired credentials and an injected instruction inside a tool result.
Check your understanding
Neither user text nor tool output can expand the granted authority. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.