financial-services-interest-group

Background: There's a common misconception among stakeholders that MCP provides protocol-level support for downstream authorization (AuthZ) propagation. In reality, authentication terminates at the MCP server boundary, and any downstream authorization or identity propagation is the responsibility of individual server implementations. Proposal: Develop a whitepaper documenting best practices and proven architectural patterns for implementing secure downstream authorization and identity propagation in MCP servers. Scope: The whitepaper should cover: Best practices for preventing privilege escalation Token exchange patterns (e.g., OAuth 2.0 Token Exchange RFC 8693) On-behalf-of (OBO) flows Identity propagation strategies Trust boundary considerations Security implications and common pitfalls Goal: Provide server authors with clear guidance on implementing robust, enterprise-grade authorization mechanisms that maintain security guarantees across service boundaries.