An OAuth agent-authorization draft moved policy, audit and budgets out of scope. What that leaves a deployer to build, and where the control belongs.

Portkey, now Prisma AIRS AI Gateway, enforces MCP tool-call policy. So does Waxell — the difference is when each gateway re-checks the tool itself.

One prompt exposed every AgentCore agent in an AWS account and region. What the default role allowed, and the controls that contain it.

MCP's spec says a human SHOULD be able to deny tool calls — never MUST. Oversight that lives in the client is a liability transfer, not a control.

An OpenAI agent entered a NSW fire-data app in June; the state learned Oct 1. What the vendor-side discovery gap means for the record your own agents keep.

Agent testing measures a configuration, not a model. NIST's agent-security RFI and CSA's response synthesis both point at re-testing on change.