More than 20 percent of the MCP-related access policies that Shawn Petty’s team reviewed across customer and prospect environments were broken or missing, according to a recent account published in The New Stack. In most cases, the MCP server ran on someone’s personal token rather than a service account.At 12 p.m. Eastern/9 a.m. Pacific on Tuesday, October 27, Petty, Chief Customer Officer at CloudBolt, and Mike Bombard, Director of Global Pre-Sales Engineering at CloudBolt, will join The New Stack host Viktor Farcic for a live demo of how to trace an agent’s actions back to the person responsible for them. REGISTER NOW FOR THIS WEBINARWhat's holding your team back from automating Kubernetes resource optimization further?*Please selectWorried it will restart pods or cause disruptionWorried it will interfere with autoscaling (HPA) behaviorNot confident it handles unpredictable/bursty workloads (like AI/inference) wellNothing technical — it's a process or approval issue, not a tooling oneEmail *First Name *Last Name *Job Role *Please selectAI Researcher / Research ScientistArchitectBusiness Development/Marketing/SalesCommunity Manager / Developer AdvocateData Analyst / Business Intelligence AnalystData EngineerData ScientistDeveloper / Software EngineerDevOps EngineerEducator / InstructorEnthusiast/HobbyistFounder / Entrepreneur / Investor / VCIT management, including CIO/CISO/CTO/CDOMachine Learning EngineerMLOps Engineer / Infrastructure EngineerProduct ManagerSecurity / Privacy ProfessionalStatistician / Quantitative AnalystStudentSysAdmin/Operations/SRETechnical WriterUX / UI Designer / Data Visualization SpecialistJob Level *Please selectC-LevelFounder/OwnerVP/DirectorManager/SupervisorMid Level or Senior Individual ContributorEntry Level or Junior Individual ContributorFreelancer/ContractorEducator (Teacher, Instructor, Professor)Student/InternOtherN/AIndustry *Please selectAdvertising/MarketingAerospace/AviationAgricultureAutomotiveBiotech/PharmaceuticalBusiness Services (accounting, consulting, etc.)Computers/Information TechnologyConstructionEducationFacilities/Service IndustryFinance/Financial Services (banking, insurance, etc.)GovernmentHealthcareHuman ResourcesLegalLife sciences (biotech, pharmaceuticals, etc.)ManufacturingMediaNon-profitReal EstateRetail/Consumer GoodsTelecommunicationsTransportation/LogisticsTravel/Hospitality/EntertainmentUtility/EnergyOrganization *Country *Please selectUnited StatesCanadaUnited KingdomAfghanistanAlbaniaAlgeriaAndorraAngolaAntigua and BarbudaArgentinaArmeniaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBhutanBoliviaBosnia and HerzegovinaBotswanaBrazilBruneiBulgariaBurkina FasoBurundiCabo VerdeCambodiaCameroonCentral African RepublicChadChileChinaColombiaComorosCongoCongo (Democratic Republic)Costa RicaCote d’IvoireCroatiaCubaCyprusCzech RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEswatiniEthiopiaFijiFinlandFranceGabonGambiaGeorgiaGermanyGhanaGreeceGrenadaGuatemalaGuineaGuinea-BissauGuyanaHaitiHondurasHungaryIcelandIndiaIndonesiaIranIraqIrelandIsraelItalyJamaicaJapanJordanKazakhstanKenyaKiribatiKorea (North)Korea (South)KuwaitKyrgyzstanLaosLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMauritaniaMauritiusMexicoMicronesiaMoldovaMonacoMongoliaMontenegroMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew ZealandNicaraguaNigerNigeriaNorth MacedoniaNorwayOmanPakistanPalauPalestinePanamaPapua New GuineaParaguayPeruPhilippinesPolandPortugalQatarRomaniaRussiaRwandaSaint Kitts and NevisSaint LuciaSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSouth SudanSpainSri LankaSudanSurinameSwedenSwitzerlandSyriaTaiwanTajikistanTanzaniaThailandTimor-LesteTogoTongaTrinidad and TobagoTunisiaTurkeyTurkmenistanTuvaluUgandaUkraineUnited Arab EmiratesUruguayUzbekistanVanuatuVatican CityVenezuelaVietnamYemenZambiaZimbabweState *Phone NumberRegisterBy registering, you consent to The New Stack’s Privacy Policy, Terms of Useand to receiving email communication from The New Stack and our event partner. You may opt out at any time.You have successfully registered for the webinar.$(document).ready(function() {// Get UTM parameters.var utm_source = window.tns.getUTMParameterValue('utm_source');var utm_medium = window.tns.getUTMParameterValue('utm_medium');var utm_campaign = window.tns.getUTMParameterValue('utm_campaign');var utm_term = window.tns.getUTMParameterValue('utm_term');var utm_content = window.tns.getUTMParameterValue('utm_content');if (utm_source) { $('input[name="utm_source"]').val(utm_source) }if (utm_medium) { $('input[name="utm_medium"]').val(utm_medium) }if (utm_campaign) { $('input[name="utm_campaign"]').val(utm_campaign) }if (utm_term) { $('input[name="utm_term"]').val(utm_term) }if (utm_content) { $('input[name="utm_content"]').val(utm_content) }if ( $('.airmeet-container[data-event-id]').length ) {initAirmeetRegistrationForm();}/*window.dataLayer.push({'event' : 'webinar_registration_started','object_id' : '22834862','object_type' : 'webinar','post_title' : 'Provisioned Access vs. Emergent Access: Tracing AI Agents Back to the Humans Behind Them',});*/function showFormStage( stage ){if ( stage == 1 ) {$('.airmeet-profile-fields').attr('hidden', true).hide();$('.airmeet-register').prop('disabled', true);} else if ( stage == 2 ) {$('.airmeet-profile-fields').removeAttr('hidden').show();$('.airmeet-register').prop('disabled', false);}}function initAirmeetRegistrationForm() {window.webinar_registration_started = false;var $form = $('.airmeet-registration-form');var $questionFields = $form.find('.airmeet-questions [data-question]');if ( $questionFields.length === 0 ) {showFormStage(2);}// Listen for question field values.$questionFields.on('change input', function() {var allFilled = $questionFields.filter(function() {return $.trim($(this).val()) !== '';}).length === $questionFields.length;if ( allFilled ) {showFormStage(2);}if ( ! window.webinar_registration_started ) {window.dataLayer.push({'event' : 'webinar_registration_started','object_id' : '22834862','object_type' : 'webinar','post_title' : 'Provisioned Access vs. Emergent Access: Tracing AI Agents Back to the Humans Behind Them',});}window.webinar_registration_started = true;});// Listen for job-role field, show additional fields if necessary.$form.find('select[name="job-role"]').on('change', function() {var val = $(this).val();if ( val && val !== 'student' && val !== 'enthusiast-hobbyist' ) {$('.airmeet-job-more-fields').removeAttr('hidden').show();$('.airmeet-job-more-fields').find('select, input').prop('disabled', false);} else {$('.airmeet-job-more-fields').find('select, input').val('').prop('disabled', true);$('.airmeet-job-more-fields').attr('hidden', true).hide();}});// Listen for country field, show state field for US/CA.$form.find('select[name="country"]').on('change', function() {var val = $(this).val();if ( val === 'US' || val === 'CA' ) {$('.airmeet-state-field').removeAttr('hidden').show();$('.airmeet-state-field').find('input').prop('disabled', false);} else {$('.airmeet-state-field').find('input').val('').prop('disabled', true);$('.airmeet-state-field').attr('hidden', true).hide();}});// Listen for changes on all non-question fields.$form.find('input, select').not('[data-question]').not('[type="hidden"]').on('change input', function() {window.dataLayer.push({'event' : 'webinar_registration_form_interaction','object_id' : '22834862','object_type' : 'webinar','post_title' : 'Provisioned Access vs. Emergent Access: Tracing AI Agents Back to the Humans Behind Them',});});$form.on('submit', function(e) {e.preventDefault();handleSubmit();});}function handleSubmit() {var $form = $('.airmeet-registration-form');var $btn = $form.find('.airmeet-register');$btn.prop('disabled', true).text('Registering...');// Collect CMS-configured questionsvar questions = [];$form.find('[data-question]').each(function() {questions.push({question: $(this).data('question'),answer: $(this).val()});});var data = {event_id: $form.find('input[name="event_id"]').val(),utm_source: $form.find('input[name="utm_source"]').val(),utm_medium: $form.find('input[name="utm_medium"]').val(),utm_campaign: $form.find('input[name="utm_campaign"]').val(),utm_term: $form.find('input[name="utm_term"]').val(),utm_content: $form.find('input[name="utm_content"]').val(),questions: questions,'email': $form.find('input[name="email"]').val(),'first-name': $form.find('input[name="first-name"]').val(),'last-name': $form.find('input[name="last-name"]').val(),'job-role': $form.find('select[name="job-role"]').val(),'job-level': $form.find('select[name="job-level"]').val(),'industry': $form.find('select[name="industry"]').val(),'organization': $form.find('input[name="organization"]').val(),'country': $form.find('select[name="country"]').val(),'state': $form.find('input[name="state"]').val(),'phone-number': $form.find('input[name="phone-number"]').val()};$.ajax({url: '/wp-json/airmeet/register-webinar',method: 'POST',contentType: 'application/json',data: JSON.stringify(data),success: function(response) {var status = response && response.status;var eventName = status === 'already_registered'? 'webinar_registration_already_registered': 'webinar_registration_completed';window.dataLayer.push({'event' : eventName,'object_id' : '22834862','object_type' : 'webinar','post_title' : 'Provisioned Access vs. Emergent Access: Tracing AI Agents Back to the Humans Behind Them',});showSuccess();},error: function(xhr) {var msg = 'Registration failed. Please try again.';if ( xhr.responseJSON && xhr.responseJSON.error ) {msg = xhr.responseJSON.error;}alert(msg);$btn.prop('disabled', false).text('Register');}});}function showSuccess() {var mastheadHeight = $('#tns-header-masthead').length ? $('#tns-header-masthead').outerHeight() : 0;var adminBarHeight = $('#wpadminbar').length ? $('#wpadminbar').outerHeight() : 0;var padding = $(window).width() > 1024 ? 120 : 50;$('html, body').animate({ scrollTop: $('.airmeet-container').offset().top - mastheadHeight - adminBarHeight - padding }, 300, function() {$('.airmeet-registration-form').attr('hidden', true).hide();if ( $('.airmeet-video').length ) {// Video embed, prepare the iframe and show.$('.airmeet-video iframe').attr('src', $('.airmeet-video iframe').attr('data-src'));$('.airmeet-video').show().removeAttr('hidden');} else {// Thank you screen.$('.airmeet-success').removeAttr('hidden').hide().fadeIn();}});}}); The problem, though, usually shows up after an incident: That personal token puts an engineer’s name into the audit trail for everything the agent did. Meanwhile, a shared service account puts the account’s name there instead. In both cases, the audit trail isn’t able to identify who precisely asked the agent to do the work or who approved the access it used.Access that goes through a request, approval, and grant in the identity provider is provisioned, and the identity provider records it. Access that an agent picks up along the way is emergent: A role inherited from the service that launched it, or a developer’s own token lent out to finish a task. The identity provider holds no record of those grants, so when an agent touches something it shouldn’t, you can’t trace it back.In this live conversation, the CloudBolt team will explain how agents end up with access nobody approved, then show how to trace that access back to a person with CloudBolt: linking agent activity to your existing identity provider, setting limits on what an agent can touch, and reading the audit trail that results. Live attendees can ask these experts questions in real time. Register today to join us!You’ll learn:How to tie agent activity back to your existing identity provider instead of building a parallel systemWhich infrastructure actions an agent should be allowed to take without a human signing offWhat a usable audit trail for agent behavior contains, and how to keep one without slowing teams downA live trace of one agent’s credentials and actions, from the task it ran to the person responsibleCan’t join us live? Register anyway, and we’ll send you a recording after the session. By registering, you consent to receiving email communications from The New Stack and CloudBolt.The post The agent did the work. The audit log couldn’t say who asked. appeared first on The New Stack.