Authentication vs Authorization in MCP

Authentication answers who the caller is. Authorization answers what that caller can do.

Why the distinction matters

A user may be validly authenticated but still lack permission to read another tenant's records or execute a production deployment.

Tool-level checks

Authorization should consider tool name, target resource, tenant, ownership, role, scope, and sometimes business state. A generic “authenticated=true” flag is rarely sufficient.

Do not trust model-generated identity fields

If the tool accepts user_id, the model can generate any value. Derive caller identity from authenticated context and only use explicit IDs as target resources after permission checks.