Tool process_refund

A tool AI agents call, on the MCP server Example Corp assistant.

No approved baseline: nobody approved this tool's scopes.

Says about itself

readOnlyHint: false, destructiveHint: false, openWorldHint: false

Calls

createRefund, approveRefund

Scopes it holds

refund:under_500

• Warning High-impact tool, plan a human approval

  This tool can delete, pay, execute or administer, from its annotations or its scopes. A consent given once at sign-in does not cover each of these actions.

  ScopeNeat recommendation: Ask a human to approve each call, with the details of the action, before it runs.

  Next step: The resource owner approves the tool and its human approval mode, with security consulted because the tool changes state.

  Accountable Resource owner

  Sources: Published security guidance

  Use human-in-the-loop control to require a human to approve high-impact actions before they are taken.

  Prompt for user confirmation on sensitive operations

• Warning The tool can both start an action and approve it

  One tool, and so the one token behind it, can create an item and approve items of the same kind. A misled agent can complete both steps, and the second pair of eyes becomes a formality.

  ScopeNeat recommendation: Split the tool in two, and leave approving to another client or to a person. Or give approving the human approval mode.

  Next step: The MCP server owner splits the tool, security is consulted on who approves, and the resource owner approves the new mapping.

  Accountable Resource owner

  Sources: YogaSec practice

  Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion.

  References (2)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • RTS 2024/1774 Art. 21(b) Supports evidence

    the segregation of duties designed to prevent unjustified access to critical data or to prevent the allocation of combinations of access rights that may be used to circumvent controls

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.

  • ISO/IEC 27001 A.5.3 Supports evidence

    Segregation of duties

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.