Your MCP Server Is Secure. The Ledger Behind It Isn’t.

In a recent piece here on Unite.AI, Gil Feig laid out six best practices for building a secure MCP server. They are sound, and anyone shipping an MCP server should follow them. His advice to give each integration “its own fine-grained role, scoped strictly to required permissions” is exactly right. It also assumes the system on the other end has fine-grained roles.

That points to a broader assumption that rarely gets stated: that the systems behind the server can be secured to the same standard. In business software, they often cannot. I run the engineering team behind an integration layer that connects to 32 accounting and ERP systems, with an optional MCP server on top. We regularly see agents that are well authenticated, well scoped and well logged on our side, writing into systems that have no way of knowing an agent was involved at all.

This piece is about that second half of the problem: what the upstream systems actually offer, what you can control from the integration layer, and where that control ends. The MCP authorization specification is…