Agent Identity & Security
Can I use workload identities to authorize which tools an AI agent can call via MCP?
Yes. Catalyst ties workload identities to MCP tool authorization policies, so each agent can only invoke tools its identity is permitted to use. You define policies that specify which agent identities may call which MCP tools, under what conditions (e.g., rate limits, required claims). This prevents an agent from accidentally or maliciously calling unauthorized tools, even if the agent framework supports them. Policies are evaluated at runtime before each tool invocation.
Was this article helpful?
Your feedback helps improve Diagrid's FAQ experience.
Keep reading
More Diagrid FAQ articles
- Agent Identity & Security
What is a workload identity for an AI agent and why can't I just use a shared API key?
Explains workload identity for AI agents and the security limits of shared API keys in production.
- Agent Identity & Security
How does Catalyst assign a workload identity to an agent runner like LangGraph or CrewAI?
Describes how Catalyst injects workload identities into framework-agnostic agent runners.
- Agent Identity & Security
What security problems do shared API keys cause when multiple agents run in production?
Lists security problems from shared API keys in multi-agent production environments.