Skip to content
IOmergent
Talk to us
Home Fractional CISO Managed Cloud Security Solutions Industries Resources About Talk to a CISO

AI Security Reference ArchitecturesTrack C: AI you ship

C1 Customer Agents on Your API

C1 is for SaaS companies whose customers connect their own AI agents to your API or to an MCP server you publish. It's feasible today: buy an authorization server that supports the MCP spec, then build the MCP server, tenant scoping and write confirmations yourself. You don't control the agent, so your controls go on scoped tokens, argument checks in your server and confirmations the agent can't answer itself.

Buy + glue Owner: Platform eng + security Control: Med to High Stand up: 2 to 12 wks

Who it fits: B2B SaaS whose customers connect AI agents to your API or an MCP server you publish. You don't control the agent, so you control what it can reach.

Frameworks: AWS GenAI scope 3AWS agentic scope Prescribed (out-of-band confirm)OWASP ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI09 Human-Agent Trust Exploitation

Last reviewed October 2026. Vendor tiers and features change often. Spot something out of date? Tell us.

FlowsPrompt / responseTool callIdentity / credentialTelemetryUnsafe pathBlocked
BoundariesYour boundaryThird party

How Customer Agents on Your API works

Customer's environmentYour platform1234567WORKLOADCustomer's agentClaude, ChatGPT, customCONTROLAPI / MCP gatewayauth, rate limitsKEEPIDENTITYYour OAuth serverconsent, scoped tokensKEEPCONTROLConfirm stepout-of-band, per actionKEEPWORKLOADYour MCP serverscoped, read-first toolsKEEPCONTROLClient allowlistCIMD, pre-registeredKEEPTOOLSYour services & dataper-tenant scopesTELEMETRYAgent activity logper client and tenantSIMPLIFY

Data flow

  1. 1A customer's AI agent calls your API or MCP server on behalf of one of their users.
  2. 2Your OAuth server issues scoped, short-lived tokens after the user consents. Agents never get long-lived API keys.
  3. 3An allowlist of client ID metadata documents (CIMD) decides which agent apps may ask for tokens. Open dynamic registration stays off.
  4. 4The gateway checks every token and rate-limits per client. The MCP server, not the gateway, validates tool arguments.
  5. 5Your MCP server exposes a small set of scoped tools, read-only first, and reaches your services only within the user's tenant and scopes.
  6. 6Writes and destructive actions need the user's confirmation outside the agent, tied to that exact action.
  7. 7Every call is logged per client and per tenant, so you can spot and revoke a misbehaving agent.

Build or buy

Buy + glue

What you can buy for each box in the diagram, the open source option, and the part you still build yourself.

ComponentBuyOpen sourceYou buildMaturity
Customer's agentClaude, ChatGPT, Cursor, VS Code and custom clients·Test the OAuth flow with every client you list as supportedGA
API / MCP gatewayCloudflare (Advanced Rate Limiting on Enterprise for per-client limits), Kong AI Gateway Enterprise, Zuplo MCP Gatewayagentgateway, Kong Gateway OSS, EnvoyRate limits keyed by OAuth client and tenantGA
Your OAuth serverAuth0 Auth for MCP, WorkOS AuthKit, Descope, Stytch Connected AppsKeycloak, Ory Hydra, Cloudflare workers-oauth-providerScope design, consent text, short token lifetimes, per-client revocationGA
Client allowlistCIMD allowlists and pre-registered clients in Auth0, WorkOS, Descope or StytchKeycloakAdmin setting that lets each customer choose which agent apps their tenant allowsGA
Your MCP serverHosting only, such as Cloudflare Workers or your own infrastructureOfficial MCP SDKsSmall read-first toolset, argument validation, output trimming, tenant isolationGA
Confirm stepAuth0 asynchronous authorization (CIBA), MCP URL-mode elicitation·Out-of-band approval page, single-use confirmation tied to the exact action and argumentsPreview
Your services and data··Take the tenant from token claims, never from tool arguments, and enforce row-level checksGA
Agent activity logWorkOS Audit Logs or your existing log stackOpenTelemetryLog view each customer can see, plus a revoke button per agent appGA

Rollout steps

#StepWhoEffort
1Choose three to eight read-only tools and define scopes for themProduct manager and backend engineer1 week
2Set up the auth vendor with protected resource metadata, CIMD, pre-registered clients and short-lived tokensBackend or identity engineer1-2 weeks
3Build the MCP server on the official SDK for the 2026-07-28 spec, staying compatible with 2025-11-25Backend engineer2-4 weeks
4Put a gateway in front with per-IP limits plus per-client and per-tenant limitsPlatform engineer1 week
5Log client, tenant, user and tool for every call, and add a revoke actionBackend engineer1-2 weeks
6Add a client allowlist and a setting for customer admins to allow agent appsBackend and frontend engineer1-2 weeks
7Add writes behind an out-of-band confirmation tied to the exact actionBackend and frontend engineer2-3 weeks
8Test for cross-tenant access, injected agents and token replay, then get an outside pentestSecurity engineer and outside tester1-2 weeks
9Test the connection with every agent client you listQA or backend engineer1 week

What you still build

  • The MCP tools: names, descriptions, argument schemas and output trimming
  • Tenant scoping from token claims, with tests that try cross-tenant access
  • A pending-action record and an out-of-band confirmation page bound to a hash of the arguments
  • Rate limits and quotas keyed by client and tenant
  • Customer-facing controls: allowed agent apps, activity log and revoke
  • Compatibility testing across MCP spec versions and agent clients

Gotchas

  • The MCP 2026-07-28 spec deprecates Dynamic Client Registration in favor of Client ID Metadata Documents. Allowlist known client URLs instead of opening registration.
  • If the agent receives the confirmation prompt, an injected agent can approve its own action. Send the confirmation to the user out of band.
  • Gateways see MCP as one JSON-RPC endpoint, so your MCP server has to validate tool arguments.
  • Never trust a tenant or account ID passed in tool arguments. Take it from the token.
  • Per-client rate limits on Cloudflare need Enterprise Advanced Rate Limiting or your own code.
  • Client support for the spec varies. Users report Claude Code working where the claude.ai web connector fails, so test each client.
  • The 2026-07-28 spec removed sessions and the initialize handshake. Older SDKs and docs may still assume them.

Common use cases

  • MCP server for your product
  • Agent-ready public APIs
  • Customer automations and integrations
  • Partner and marketplace agents

Key risks

  • Long-lived API keys pasted into agent configs
  • Prompt-injected agents calling your tools
  • Over-broad scopes across tenants
  • An injected agent approving its own action

Fast path

  • KEEPOAuth with scoped, short-lived tokens
  • KEEPRead-only tools first
  • KEEPAllowlist known clients. No open dynamic registration
  • KEEPPer-client rate limits
  • DEFERAgent behavior analytics until volume grows

Sources

Vendor documentation and announcements we checked for this page. Products are examples of a category, not endorsements.

Not sure which pieces to buy and which to build?

Bring the AI tools your teams use today and the data they touch. In a 30-minute call we map you to these models and name the controls to add first. No sales pitch.

Talk to a CISO