Entitlement-Aware Authorization for MCP-Based AI Search and Chat Systems

Large-language-model (LLM) agents increasingly reach enterprise data through the Model Context Protocol (MCP). MCP standardizes how a model discovers and invokes tools exposed by back-end systems, but not who may invoke which tool on whose behalf, nor which rows they may receive in the response. This paper defines an entitlement-aware authorization architecture for MCP, a first-class Policy Decision Point (PDP) and per-tool Policy Enforcement Points (PEPs) sit between the AI orchestrator and the back-ends, consume the end-user’s attested identity and attributes, produce obligations that narrow returned rows, and record every decision in a unified audit stream. The design composes with OAuth 2.1, OIDC, and JWT infrastructure and with the three common MCP-to-back-end integration patterns (service-account, token-passthrough via OAuth Token Exchange, and per-user credentials). AI orchestrator that can invoke MCP tools against multiple enterprise back-ends is prevented from leaking sensitive data by an externalized, identity- and attribute-aware authorization layer.