Oleksandr Kuzmenko, EditorPublished 7 min readAI-assisted · editor-reviewed
Why it matters
Eliminate the risk of Cursor or Claude Code agents deploying directly to production by intercepting tool calls with runtime policy checks.
TL;DR
- 01System prompts and specs instruct behavior but cannot block operations permitted by active credentials.
- 02Runtime authorization engines should classify MCP tool calls into risk categories like read, write, deploy, and data access.
- 03Ephemerally minted credentials should be terminated immediately upon task completion or timeout.
Key facts
- Risk Classification Tiers
- Read, write, deploy, notify, money, sensitive data
- Access Lifecycle
- Zero standing authority between discrete tasks
Why Specs Fail to Restrict Execution
Prompt engineering and strict specifications guide an agent's reasoning, but they do not enforce infrastructure isolation. If an automation agent or coding assistant receives a token with write access to production infrastructure, any failure mode, prompt injection, or logic error can result in unintended deploys. The principle of least privilege requires that credentials match the exact boundary of the approved task rather than the broad capabilities of the developer running it.
Credential Hierarchy for Coding Agents
The transition to zero standing permissions organizes access across four maturity stages:
- Static API Keys: High risk. Permanent, over-scoped, difficult to rotate, and impossible to correlate with specific human-approved tasks.
- Service Accounts: Moderate risk. Segregated from human identities, suitable for read-only background indexing, but vulnerable when broad scopes are left active permanently.
- OAuth Delegated Access: Improved. Actions execute within the user's explicit scope and support centralized revocation, but permissions remain coarse.
- Runtime Policy & Ephemeral Tokens: Lowest risk. Zero standing permissions where the runtime evaluates tool parameters dynamically, minting short-lived tokens only after verifying policy rules.
Implementing Model Context Protocol Policy Gates
For developers orchestrating agents in Cursor or Claude Code via Model Context Protocol (MCP) servers, audit schemas should capture the ticket reference, agent runtime version, active policy version, token expiry, and exact tool parameters. Intercepting high-risk MCP tool calls—such as deployment pipelines or database migrations—at the runtime policy level prevents configuration drift from compromising production systems.
Try it in 2 minutes
{
"task_id": "task_deploy_8841",
"agent": "claude-code-cli",
"requested_tool": "mcp_k8s_deploy",
"target_env": "staging",
"risk_tier": "write",
"standing_permission": false,
"token_ttl_seconds": 300
}json
✓ When to use
- Orchestrating agent workflows that execute cloud infrastructure provisioning, migrations, or deployments.
- Exposing production-adjacent MCP servers to autonomous coding assistants in developer environments.
✕ When NOT to use
- Local single-user prototyping environments without access to cloud deployment credentials or databases.
- Read-only documentation search and local code indexing routines.
What to do today
- Audit environment variables exposed to Cursor and Claude Code MCP configs for production credentials.
- Classify existing agent tool definitions into read, write, deploy, and sensitive risk tiers.
- Configure runtime authorization middleware to issue short-lived task-scoped access tokens.