Runtime Authorization Consistency Checking for MCP-based Agentic Workflows

Agentic systems often execute complex tasks by chaining multiple tool calls. A significant security risk arises when individual calls are locally permitted but, when viewed as a sequence, exceed the original authorization scope granted by the user—a phenomenon the authors term authorization drift. To address this, the authors propose Runtime Authorization Consistency (RAC), a lightweight pre-commit guard that sits at the controller-side tool-call boundary. RAC treats authorization as a dynamic state that evolves with the workflow, ensuring that every new tool call is supported by the authorization basis inherited from previously accepted steps.

RAC significantly outperforms existing security baselines in preventing authorization drift. In evaluations using the TraceBench suite, which contains 1,248 controlled workflows, RAC achieved a 0% missed-block rate, whereas the strongest baseline (Static+History) missed over 50% of oracle-BLOCK cases. In a study using real MCP filesystem workflows, RAC successfully stopped nine unsafe continuations before they reached the server, preventing unauthorized file operations. Performance measurements indicate that RAC is highly efficient, with p99 checking latency remaining under one millisecond, making it suitable for real-time agentic workflows.

As agentic systems gain the ability to interact with sensitive files and external services, relying solely on per-call authorization is insufficient. This paper provides a robust framework for maintaining security throughout the entire lifecycle of an agentic workflow. By making the authorization basis explicit and verifiable, RAC allows developers to enforce strict security boundaries without requiring changes to the underlying tool protocols or server implementations.