arXiv: A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem

AI Analysis

This publication introduces a technical architecture for standardizing authentication across enterprise AI systems using the Model Context Protocol, which allows AI assistants to access external tools and data. The paper addresses a critical compliance gap: current MCP implementations lack unified identity management, creating ambiguity about whether an action is performed by a human user or an autonomous AI agent. The proposed gateway design centralizes authentication, supports identity delegation, and explicitly defines the user versus non-user persona problem, which is essential for audit trails and accountability.

The affected organizations are any enterprises deploying AI assistants that connect to internal databases, customer records, or financial systems, particularly in regulated sectors like banking, healthcare, and insurance. Compliance teams in these industries will face challenges mapping AI-driven actions to specific human responsibilities under GDPR, DORA, and sector-specific conduct rules. The paper signals that regulators will increasingly expect clear attribution of AI actions to a responsible principal.

Compliance teams should monitor MCP adoption in their technology stack and assess whether current authentication logs can distinguish human-initiated from AI-initiated transactions. They should begin gap analysis on identity delegation controls, especially for privileged access, and engage engineering teams to pilot the proposed gateway model in sandbox environments. Proactive documentation of AI action attribution will ease future audits and reduce liability exposure.