{
  "title": "MCP Gateway Identity, Credential, and Authorization Framework",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP 2026-07-28",
  "sourcePackage": "research/11",
  "integrityNote": "All 84 listed archive payloads verify by SHA-256. Public datasets are a narrow, noindex selection; product rankings and unexecuted test results are not published.",
  "checkedAt": "2026-08-26",
  "indexing": "noindex, follow",
  "evidencePolicy": "Archive source IDs are mapped to the site-wide canonical evidence library; analytical rows disclose dataset-level evidence.",
  "count": 22,
  "records": [
    {
      "Flow": "Public unauthenticated",
      "Caller": "Any client",
      "Inbound proof": "None",
      "Outbound credential": "None/public backend",
      "Best fit": "Public read-only service",
      "Principal risk": "Abuse and quota exhaustion",
      "id": "R11-AUTH001",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 1,
        "packageSourceIds": [],
        "raw": {
          "Flow": "Public unauthenticated",
          "Caller": "Any client",
          "Inbound proof": "None",
          "Outbound credential": "None/public backend",
          "Best fit": "Public read-only service",
          "Principal risk": "Abuse and quota exhaustion"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Flow": "Static bearer/API key",
      "Caller": "Known application",
      "Inbound proof": "Pre-shared token",
      "Outbound credential": "Same or separate key",
      "Best fit": "Private automation",
      "Principal risk": "Rotation and poor user attribution",
      "id": "R11-AUTH002",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 2,
        "packageSourceIds": [],
        "raw": {
          "Flow": "Static bearer/API key",
          "Caller": "Known application",
          "Inbound proof": "Pre-shared token",
          "Outbound credential": "Same or separate key",
          "Best fit": "Private automation",
          "Principal risk": "Rotation and poor user attribution"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Flow": "OAuth authorization code + PKCE",
      "Caller": "Interactive user",
      "Inbound proof": "Audience-bound access token",
      "Outbound credential": "Delegated token/exchange",
      "Best fit": "User-specific SaaS",
      "Principal risk": "Mix-up, redirect and consent errors",
      "id": "R11-AUTH003",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 3,
        "packageSourceIds": [],
        "raw": {
          "Flow": "OAuth authorization code + PKCE",
          "Caller": "Interactive user",
          "Inbound proof": "Audience-bound access token",
          "Outbound credential": "Delegated token/exchange",
          "Best fit": "User-specific SaaS",
          "Principal risk": "Mix-up, redirect and consent errors"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Flow": "Client credentials",
      "Caller": "Service/agent",
      "Inbound proof": "Machine credential",
      "Outbound credential": "Service account/exchange",
      "Best fit": "Non-user automation",
      "Principal risk": "Overpowered shared identity",
      "id": "R11-AUTH004",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 4,
        "packageSourceIds": [],
        "raw": {
          "Flow": "Client credentials",
          "Caller": "Service/agent",
          "Inbound proof": "Machine credential",
          "Outbound credential": "Service account/exchange",
          "Best fit": "Non-user automation",
          "Principal risk": "Overpowered shared identity"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Flow": "On-behalf-of token exchange",
      "Caller": "Agent acting for user",
      "Inbound proof": "User/agent token",
      "Outbound credential": "Resource-specific delegated token",
      "Best fit": "Enterprise multi-hop access",
      "Principal risk": "Identity-chain loss",
      "id": "R11-AUTH005",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 5,
        "packageSourceIds": [],
        "raw": {
          "Flow": "On-behalf-of token exchange",
          "Caller": "Agent acting for user",
          "Inbound proof": "User/agent token",
          "Outbound credential": "Resource-specific delegated token",
          "Best fit": "Enterprise multi-hop access",
          "Principal risk": "Identity-chain loss"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Flow": "Enterprise-managed authorization",
      "Caller": "Managed workforce/client",
      "Inbound proof": "Enterprise IdP policy",
      "Outbound credential": "Managed resource access",
      "Best fit": "Central administration",
      "Principal risk": "Policy-plane concentration",
      "id": "R11-AUTH006",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 6,
        "packageSourceIds": [],
        "raw": {
          "Flow": "Enterprise-managed authorization",
          "Caller": "Managed workforce/client",
          "Inbound proof": "Enterprise IdP policy",
          "Outbound credential": "Managed resource access",
          "Best fit": "Central administration",
          "Principal risk": "Policy-plane concentration"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Flow": "Gateway-managed upstream OAuth",
      "Caller": "User or service",
      "Inbound proof": "Gateway token",
      "Outbound credential": "Vaulted upstream OAuth token",
      "Best fit": "Third-party servers",
      "Principal risk": "Gateway becomes token custodian",
      "id": "R11-AUTH007",
      "sourceIds": [
        "S133",
        "S499",
        "S063",
        "S500",
        "S531",
        "S005",
        "S006",
        "S004",
        "S003"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_AUTHENTICATION_FLOWS.json",
        "row": 7,
        "packageSourceIds": [],
        "raw": {
          "Flow": "Gateway-managed upstream OAuth",
          "Caller": "User or service",
          "Inbound proof": "Gateway token",
          "Outbound credential": "Vaulted upstream OAuth token",
          "Best fit": "Third-party servers",
          "Principal risk": "Gateway becomes token custodian"
        }
      },
      "frameworkPart": "Authentication and credential flow"
    },
    {
      "Identity/fact": "End user",
      "Preserve as": "Subject, groups and tenant",
      "Why": "Object-level and delegated authorization",
      "Failure mode": "Shared service identity hides accountability",
      "id": "R11-IDENT001",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 1,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "End user",
          "Preserve as": "Subject, groups and tenant",
          "Why": "Object-level and delegated authorization",
          "Failure mode": "Shared service identity hides accountability"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Host/client",
      "Preserve as": "Client ID and product/version",
      "Why": "Client policy and incident response",
      "Failure mode": "Unknown caller surface",
      "id": "R11-IDENT002",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 2,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Host/client",
          "Preserve as": "Client ID and product/version",
          "Why": "Client policy and incident response",
          "Failure mode": "Unknown caller surface"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Acting agent",
      "Preserve as": "Agent/service identity",
      "Why": "Delegation and non-human policy",
      "Failure mode": "Agent authority conflated with user",
      "id": "R11-IDENT003",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 3,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Acting agent",
          "Preserve as": "Agent/service identity",
          "Why": "Delegation and non-human policy",
          "Failure mode": "Agent authority conflated with user"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Gateway",
      "Preserve as": "Intermediary service identity",
      "Why": "Downstream trust and audit",
      "Failure mode": "Gateway impersonates every caller",
      "id": "R11-IDENT004",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 4,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Gateway",
          "Preserve as": "Intermediary service identity",
          "Why": "Downstream trust and audit",
          "Failure mode": "Gateway impersonates every caller"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Downstream server",
      "Preserve as": "Publisher, server ID, endpoint",
      "Why": "Routing, provenance, revocation",
      "Failure mode": "Tool origin ambiguous",
      "id": "R11-IDENT005",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 5,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Downstream server",
          "Preserve as": "Publisher, server ID, endpoint",
          "Why": "Routing, provenance, revocation",
          "Failure mode": "Tool origin ambiguous"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Underlying resource",
      "Preserve as": "OAuth audience and tenant",
      "Why": "Token targeting",
      "Failure mode": "Token reused at wrong service",
      "id": "R11-IDENT006",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 6,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Underlying resource",
          "Preserve as": "OAuth audience and tenant",
          "Why": "Token targeting",
          "Failure mode": "Token reused at wrong service"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Purpose/intent",
      "Preserve as": "Approved operation/context label",
      "Why": "Semantic authorization and DLP",
      "Failure mode": "Broad token used for unrelated work",
      "id": "R11-IDENT007",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 7,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Purpose/intent",
          "Preserve as": "Approved operation/context label",
          "Why": "Semantic authorization and DLP",
          "Failure mode": "Broad token used for unrelated work"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Policy version",
      "Preserve as": "Decision ID/hash",
      "Why": "Reproducible audit",
      "Failure mode": "Cannot explain allow decision",
      "id": "R11-IDENT008",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 8,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Policy version",
          "Preserve as": "Decision ID/hash",
          "Why": "Reproducible audit",
          "Failure mode": "Cannot explain allow decision"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Identity/fact": "Trace correlation",
      "Preserve as": "Trace ID and request ID",
      "Why": "End-to-end diagnosis",
      "Failure mode": "Fragmented logs",
      "id": "R11-IDENT009",
      "sourceIds": [
        "S133",
        "S531",
        "S005",
        "S192",
        "S006",
        "S533"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_IDENTITY_PROPAGATION.json",
        "row": 9,
        "packageSourceIds": [],
        "raw": {
          "Identity/fact": "Trace correlation",
          "Preserve as": "Trace ID and request ID",
          "Why": "End-to-end diagnosis",
          "Failure mode": "Fragmented logs"
        }
      },
      "frameworkPart": "Identity propagation"
    },
    {
      "Policy level": "Server",
      "Example": "Allow finance server for finance group",
      "Required inputs": "User/group, server publisher/ID",
      "Must also enforce": "Runtime target and native server auth",
      "id": "R11-POLICY001",
      "sourceIds": [
        "S133",
        "S134",
        "S533",
        "S534",
        "S535"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_POLICY_LEVELS.json",
        "row": 1,
        "packageSourceIds": [],
        "raw": {
          "Policy level": "Server",
          "Example": "Allow finance server for finance group",
          "Required inputs": "User/group, server publisher/ID",
          "Must also enforce": "Runtime target and native server auth"
        }
      },
      "frameworkPart": "Authorization policy level"
    },
    {
      "Policy level": "Primitive",
      "Example": "Allow tools but deny resources",
      "Required inputs": "MCP method/primitive",
      "Must also enforce": "Extensions and direct calls",
      "id": "R11-POLICY002",
      "sourceIds": [
        "S133",
        "S134",
        "S533",
        "S534",
        "S535"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_POLICY_LEVELS.json",
        "row": 2,
        "packageSourceIds": [],
        "raw": {
          "Policy level": "Primitive",
          "Example": "Allow tools but deny resources",
          "Required inputs": "MCP method/primitive",
          "Must also enforce": "Extensions and direct calls"
        }
      },
      "frameworkPart": "Authorization policy level"
    },
    {
      "Policy level": "Tool",
      "Example": "Deny delete_issue",
      "Required inputs": "Tool name, provenance, schema version",
      "Must also enforce": "Arguments and downstream object",
      "id": "R11-POLICY003",
      "sourceIds": [
        "S133",
        "S134",
        "S533",
        "S534",
        "S535"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_POLICY_LEVELS.json",
        "row": 3,
        "packageSourceIds": [],
        "raw": {
          "Policy level": "Tool",
          "Example": "Deny delete_issue",
          "Required inputs": "Tool name, provenance, schema version",
          "Must also enforce": "Arguments and downstream object"
        }
      },
      "frameworkPart": "Authorization policy level"
    },
    {
      "Policy level": "Argument",
      "Example": "environment must not equal production",
      "Required inputs": "Validated arguments and schema",
      "Must also enforce": "Server-side semantic validation",
      "id": "R11-POLICY004",
      "sourceIds": [
        "S133",
        "S134",
        "S533",
        "S534",
        "S535"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_POLICY_LEVELS.json",
        "row": 4,
        "packageSourceIds": [],
        "raw": {
          "Policy level": "Argument",
          "Example": "environment must not equal production",
          "Required inputs": "Validated arguments and schema",
          "Must also enforce": "Server-side semantic validation"
        }
      },
      "frameworkPart": "Authorization policy level"
    },
    {
      "Policy level": "Object",
      "Example": "Repository belongs to caller team",
      "Required inputs": "Underlying resource identity",
      "Must also enforce": "Native IAM/ownership",
      "id": "R11-POLICY005",
      "sourceIds": [
        "S133",
        "S134",
        "S533",
        "S534",
        "S535"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_POLICY_LEVELS.json",
        "row": 5,
        "packageSourceIds": [],
        "raw": {
          "Policy level": "Object",
          "Example": "Repository belongs to caller team",
          "Required inputs": "Underlying resource identity",
          "Must also enforce": "Native IAM/ownership"
        }
      },
      "frameworkPart": "Authorization policy level"
    },
    {
      "Policy level": "Result flow",
      "Example": "Do not send PII to external host",
      "Required inputs": "Data class, destination, host/model",
      "Must also enforce": "DLP and host policy",
      "id": "R11-POLICY006",
      "sourceIds": [
        "S133",
        "S134",
        "S533",
        "S534",
        "S535"
      ],
      "evidenceStatus": "analytical row with curated dataset-level evidence",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_POLICY_LEVELS.json",
        "row": 6,
        "packageSourceIds": [],
        "raw": {
          "Policy level": "Result flow",
          "Example": "Do not send PII to external host",
          "Required inputs": "Data class, destination, host/model",
          "Must also enforce": "DLP and host policy"
        }
      },
      "frameworkPart": "Authorization policy level"
    }
  ]
}