AI agents are increasingly able to use tools that access databases, APIs, files, and other systems. But how do we make sure an agent can only access what it is supposed to?

In this talk, we’ll explore a practical approach to enforcing tool-level access control at the MCP server level. Using Hodari, a production travel assistant with four AI agents and three MCP servers, we’ll look at how sensitive data can be protected even when agents have access to powerful tools.

The talk will show four simple mechanisms for enforcing these boundaries, including access checks, restricted fields, protected records, and automated tests that inspect the entire tool registry.

We’ll then build a small example from scratch, intentionally introduce a tool that violates the access rules, and see how the test detects it automatically—even though the test was written before the new tool existed.

The session will also cover the limitations of this approach, including what happens when the application itself is compromised and when this level of access control may be unnecessary.

Attendees will leave with a practical understanding of how to design and test access boundaries for MCP-based AI agents.