Journey: Model Context Protocol (MCP) AI Tool Fleet Governance

Phase 1 • Shared Foundation

Tenant Registration, Cryptographic Signing & SCIM Ingress

Establish the enterprise cryptographic root of trust (Software default with Thales Luna Cloud HSM option) and configure SCIM 2.0 identity ingress.

✓

New Connection: Onboarding Upstream MCP Tool Fleet Fleet #2

Previous configuration saved. Now provisioning a distinct MCP Tool Fleet Gateway.

🏛️

atom-tenant-and-crypto-root

Enterprise root of trust & cryptographic signing

Software WebCrypto

Enterprise Organization Name * Legal entity identifier used in multi-tenant policy isolation.

🏥 UK NHS Healthcare Organization

Check this box if this organization is a UK NHS Trust, Health Board, or ICB requiring an ODS code.

Primary Cloud Region

Cryptographic Root of Trust Free Tier Default

Root CA for signing MCP tool call tokens, cryptographic Merkle chains, and AuthZEN assertions. Software is standard default (Free); Thales Luna HSM is available as a paid enterprise hardware add-on.

Software Managed Key Root

RFC 7517 WebCrypto RSA-4096 / Ed25519 • Free Tier Included

Phase 2 • Universal Identity

Non-Human Identity (NHI) & 4-Role Human Sponsorship

Define the AI agent profile and bind designated human supervisors chosen via SCIM directory search.

🤖

atom-nhi-agent-identity

AI Agent Non-Human Identity registration

RFC 7519

Governed Agent NHI (Subject Identifier)

Foundation Model & Runtime

Agent Calling Client

🛡️

atom-four-role-human-sponsorship

Designated human supervisors bound via SCIM

QUORUM SIGN-OFF

Designated SRE Supervisor SCIM Synced

Business / Procurement Owner SCIM Synced

Escalation On-Call Contact

⚡

atom-autonomy-and-guardrails

L0–L4 Autonomy Boundary & Blast Radius Control

Level 2: Human-on-the-Loop

L0: Read Only L1: Suggest L2: Guarded Actions L3: Semi-Auto L4: Autonomous

Veto Destructive Methods Vendor Contract Expiry Gate UK Data Residency Veto

Phase 3 • Unique Workload Cartridge

MCP Tool Server Discovery, Policy Checklist & Vendor Contract

Connect to the upstream MCP tool server, query `tools/list`, assign fine-grained method policies, and bind to commercial agreements.

🔌

Upstream MCP Tool Server Target

JSON-RPC endpoint over SSE or HTTP transport

RFC 9728

Tool Server Name

Upstream MCP URL (Internal VPC / Service)

Transport Protocol

Gateway Public Endpoint

📜

Commercial Vendor Contract Binding

Automated legal & procurement expiration checks

LEGAL COMPLIANT

Vendor Contract Identifier

Contract Expiration Date

Procurement Status

ACTIVE & BOUND

If this contract expires or is terminated by procurement, AuthHub MCP Gateway instantly returns HTTP 403 Forbidden with VENDOR_CONTRACT_EXPIRED in <1ms.

Discovered Upstream MCP Tools tools/list (5 Discovered)

Assign method-level execution policies evaluated live at the OAuth 2.1 gateway

Tool Name & Description	Target Resource	Gateway Policy	Guardrail Condition
k8s_read_logs Dumps container pod logs for triage	pod:logs	ALLOW	Read-only diagnostic access
k8s_describe_pod Inspects pod spec, exit codes and k8s events	pod:describe	ALLOW	Read-only event inspection
k8s_restart_pod Sends SIGTERM to restart crashing pod	pod:restart	CONDITIONAL	Requires active ticket (INC-xxxx)
k8s_delete_pod Deletes pod instance from replica set	pod:delete	FORBIDDEN	Hard Deny • Anti-Tamper Veto
sql_read_telemetry Queries application metrics table	database:telemetry	ALLOW	Read-only, PII masked

Phase 4 • Safety & Operations

FinOps Budget, Clock-1 Kill Switch & Merkle Audit Proof

Set tool rate limits, arm the sub-50ms instant revocation kill switch, and verify RFC 3161 Merkle audit hash-chaining.

💰

FinOps & Tool Budgets

atom-finops-cost-governance

Max Tool Invocations / Hour

Daily LLM Token Budget

Auto-Downgrade: Switches agent to Claude 3.5 Haiku if token threshold exceeds 80%.

⚡

Clock-1 Kill Switch

atom-clock1-killswitch-and-caep

ARMED & ACTIVE

<50ms WebSocket Severance

Instantly terminates all active MCP sessions and invalidates bearer tokens across the fleet upon supervisor trigger or CAEP event.

🔒

Merkle Hash Audit Proof

atom-merkle-audit-tsa-proof

Latest Merkle Root Hash

0x9c3f7b2a8e1045da17cb2309e4f5891a

Every JSON-RPC tool input and response payload is hashed and anchored via RFC 3161 Time-Stamp Authority for forensic auditability.

RFC 3161 TSA Anchored • Merkle Leaf Valid

Phase 5 • Verification & Live Sandbox

Live MCP Gateway Verification & Registration

Simulate authenticated tool calls against the AuthZEN policy engine and register the gateway connector into the console.

🧪

Interactive JSON-RPC Tool Execution Sandbox

Test live OAuth 2.1 PEP evaluation: PERMIT read operations vs DENY forbidden methods

GATEWAY ONLINE

⏸ Admin Gateway State (Maintenance Mode) ENABLED (ACTIVE)

Soft-drain and pause gateway traffic for maintenance without triggering SecOps alerts or Merkle audit key invalidation.

OAuth 2.1 PEP Gateway In-Path

Normal proxying to AuthZEN policy evaluation & upstream MCP servers

Target MCP Tool to Invoke

JSON-RPC Tool Arguments

Gateway PEP Decision • AuthZEN RFC 9728 1.2ms latency

// Ready to test. Click 'Execute Tool Call' to evaluate against live AuthHub PEP.

> Subject: ai_agent:claude-sre-fleet-01

> Upstream: https://mcp-tools.internal.enterprise.com:3002/mcp

> Vendor Contract: Enterprise Contract #UK-NHS-2026-89 (VALID)

Decision: STANDBY

Complete Onboarding & Register Gateway Ready for Production

Commit this configuration to AuthHub Gateway, enforce AuthZEN method policies, and register this MCP Tool Fleet under Connections & Gateways in the console.

In-Progress MCP Gateway Setup Restored

Governing Model Context Protocol (MCP) Tool Fleets