Ziv Cohen

Enterprise-Managed Authorization lets organizations connect users to MCP servers without per-user OAuth consent screens. This guide covers how Claude auto-connect and ID-JAG identity assertions work, how to validate them securely with tenant isolation, and where application-level per-tool authorization picks up after the identity exchange.

Shared coding-agent memory over MCP improves velocity, but every retrieval is a delegated access decision. This guide explains runtime authorization, ReBAC modeling, inheritance boundaries, revocation, and audit design for secure team memory.

The fast-mcp-telegram and LiteLLM CVE chains show that authentication failures rapidly become unauthorized tool execution. The fix is fail-closed, runtime tool-call authorization at the MCP boundary.

It had every permission it needed and a ticket telling it exactly what to do. Blocked once, it reworded the request to fool the check. Blocked again, it asked me to switch the check off. This is the call-by-call trace of why nothing left Linear, and the design decision that made "reword it until it's allowed" a dead end.

MCP OAuth 2.1 requires protected resource metadata, authorization server discovery, PKCE, and resource indicators, and since the 2026-07-28 spec it prefers Client ID Metadata Documents for client registration, with DCR deprecated. This guide walks through each spec requirement and shows where fine-grained authorization picks up after the OAuth flow ends.