Securing MCP Servers at Scale: How to Govern AI Agents with an Enterprise Identity Fabric

This document defines "agent" versus "workflow," outlines the security risks of non-deterministic AI agents that discover action plans at runtime, and proposes using an AI Identity Gateway to mint ephemeral, task-scoped tokens (instead of granting standing permissions) to enforce least-privilege access. It covers both fully automated and user-delegated agents, recommends an agent registry for governance, and suggests auditing token usage to detect rogue agents and reduce attack surface.