Microsoft says MCP needs a policy point before tool execution.

The gap Microsoft is describing

In April 2026, Microsoft published “Securing MCP: A Control Plane for Agent Tool Execution.” The post argues that MCP standardizes an execution surface but does not provide a built-in point where policy is evaluated before a tool call runs.

Microsoft also published an internal red-team result: prompt-only safety instructions produced a 26.67% policy-violation rate across its stated benchmark. The lesson is narrow but important. Instructions to the model are not the same thing as an authorization boundary.

What changes when tools can write

A read-only search tool and a production deployment tool should not have the same permission model. The decision needs context: which agent is acting, which user delegated the work, which resource is targeted, the exact arguments, and whether the action is reversible.

Microsoft calls out risks such as poisoned tool output, untrusted servers, cascading retries and missing circuit breakers. These are execution problems. They need controls at execution time.

Why this is relevant to RaksHex

RaksHex is built around the same architectural question: should this proposed action execute? Its useful role is not to tell a model to “be careful.” It is to evaluate delegated authority and policy outside the model, release credentials only when the decision permits the action, and record the decision in the Action Ledger.

The market is moving quickly here, which raises the bar. RaksHex needs strong argument-level policy, agent identity, approvals, credential mediation and reproducible enforcement evidence. A generic MCP proxy will not be enough.

Primary source

• Microsoft for Developers — Securing MCP: A Control Plane for Agent Tool Execution