1%TOP ONE PERCENT AIA Speaker Guide for Event Organizers and Planners
← Article library

AI Security

Before Connecting an AI Assistant, Review Who Operates the Tools

An executive review of MCP connector ownership, authorization boundaries and change control before an AI assistant reaches business systems.

Top One Percent AI · Practical guidance with linked sources.

An AI assistant that can search a document is useful. An assistant connected to the system that changes that document introduces a different decision. Who operates the connection, and what happens when that connection changes?

Model Context Protocol, or MCP, provides a common way for AI applications to connect with tools and data. A compatible connection can simplify integration. Compatibility alone does not answer whether a particular operator, implementation or requested permission is appropriate for your organization.

This review focuses on the connector relationship. It complements an agent permission review by asking what sits between the assistant and the business system.

Name every party in the path

Ask the team to draw the path from the employee to the AI application, the MCP server and the underlying service. Label who operates each component and which identity each uses. Include any intermediary that handles authentication or forwards a request.

A product name is insufficient. Your team should be able to explain whether the connector is operated by the application vendor, the underlying service provider, your organization or another party. Record the responsible support and security contacts before relying on it.

For an executive review, use one ordinary workflow. Follow a request to retrieve an invoice, for example, all the way to the system of record. Ask which parties could see the request, the result and any credentials involved.

Have the technical owner explain the authorization boundary

The official MCP security guidance discusses risks including confused-deputy behavior, token passthrough and session hijacking. A confused deputy is a component that can be misled into using its authority for another party. The guidance calls for appropriate client consent in relevant proxy flows and prohibits accepting tokens not issued for the MCP server.

Executives do not need to inspect the authentication code in the meeting. They do need a named technical owner who can explain how the implementation meets the applicable requirements and provide review evidence. Avoid accepting “it uses OAuth” as the whole answer. OAuth is an authorization framework; the implementation still matters.

Review changes as new decisions

Agree which changes trigger another review. Useful candidates include a different server operator, additional tools, broader data access, a new destination or a change from retrieval to record modification.

This is a proposed operational practice, not a claim that the protocol automatically enforces your change process. Decide how your team will discover those changes. A policy that depends on someone noticing a release announcement may be too weak for a sensitive workflow.

Ask who can suspend the connection, who receives change notifications and how the business owner will learn that a previously approved workflow now has different capabilities.

Request a small acceptance packet

Before approval, ask for a concise record containing:

Test that removal process in an authorized nonproduction environment. Do not assume removing a visible shortcut revokes every underlying grant. Have the responsible administrators verify the result without exposing credentials in the review packet.

Make the event session useful

If you are planning an AI security briefing, ask the speaker to walk through a fictional connector decision with the audience. The useful outcome is a clearer division of responsibility between business, security and platform owners. A compelling demo can introduce the topic; the approval evidence must come from the implementation your organization will actually use.