Who is actually enforcing the rules your AI agents run under?

The NSA has an answer, and it is not the protocol.

In May the NSA’s Artificial Intelligence Security Center published a cybersecurity information sheet on the Model Context Protocol, the connective layer most agent systems now use to reach tools, data and each other.

One line in it deserves more attention than it is getting. The MCP specification’s own documentation states that MCP cannot enforce its security principles at the protocol level.

The standard carrying your agents’ tool calls documents a security model and openly says it cannot enforce it.

The guidance shows what that means in practice. An MCP server you approved once can change what it does later. New capabilities, new data access, no fresh approval, no notification. Your consent was recorded at a point in time. The behaviour kept moving.

That is the difference between a control that is written down and a control that can stop an action.

The NSA’s recommendations follow that logic precisely. They do not ask for better policy documents. They ask for enforcement outside the protocol. Operating system level sandboxing around every tool execution. Signed messages with expiry and replay protection. Every tool output treated as untrusted input to the next step. Scanning your own network for MCP servers nobody authorised.

Every one of those controls shares a property. It works whether or not the agent cooperates.

If your agent governance today is a permissions page and an approval dialog, the NSA has just described your gap for you.

What in your stack could halt a tool call at the moment it happens, rather than record that it happened?