Advanced Features

This page is for admins and security leads who evaluate Permit MCP Gateway beyond authentication and trust levels. It explains what each advanced security control does and links to the page that documents its setup.

Enterprise plan

The features on this page are for Enterprise plans, and availability differs by feature. See the feature availability table, and schedule a demo to confirm availability for your deployment.

Agent Interrogation

An OAuth client ID identifies the MCP client software, such as Cursor. The client ID doesn't identify what the agent running in that client is doing. An agent's prompts and tools can change between sessions, and one MCP client connection can carry several contexts.

Agent Interrogation identifies the agent itself. Before the gateway unlocks tools, the connecting agent identifies itself and states its purpose through the MCP protocol. The gateway uses the answers to build a composite agent identity that records who the agent is, who it acts for, and what it intends to do.

How Agent Interrogation works

When an agent connects, the gateway exposes one tool: identify_self. The gateway unlocks the rest of the tool catalog after the agent completes the interrogation exchange. The exchange runs over MCP, so the agent doesn't need an extra SDK, a side channel, or a client change.

The composite agent identity combines three parts:

Part	What it records
Delegating human	The authenticated user who is accountable for the agent's actions.
Workflow context	The task the agent performs, such as "code review assistant for the platform team" or "personal research assistant".
Agent fingerprint	An identity signature derived from the agent's own responses, used to compare the agent's later behavior with its baseline.

The gateway uses the composite identity as the subject of policy evaluation, audit logging, and drift detection.

Policy enforcement with Agent Interrogation

• Tool access gate: no tool is available until the agent identifies itself, so every tool call is tied to an identified agent.
• Per-workflow policy: because the identity includes the workflow context, admins can give the same MCP client different trust levels and tools in different workflows.
• Drift reactions: when an agent's fingerprint moves away from its baseline, for example after a changed system prompt, a model swap, or a prompt injection, policy can downgrade trust, require re-consent, block execution, or require human approval.
• Step-up consent: when an agent declares destructive or sensitive capabilities during interrogation, policy can require human approval before granting access.

Auditing and governance with Agent Interrogation

Each agent session starts with a record of who the agent is and what it intends to do:

• Identity across sessions: the fingerprint lets security teams follow one agent's behavior across client restarts and reconnections.
• Declared intent and observed behavior: the agent declares the tools and data it expects to use. The gateway logs the declaration, which reviewers can compare with the tool calls the agent makes.
• Identity chain in audit logs: each tool call is attributed to the delegating human, the workflow context, the agent fingerprint, and the session.
• Drift history: admins can see when and how an agent's fingerprint changed.

Prompt injection detection with Agent Interrogation

• Baseline fingerprint: a prompt injection that changes an agent's system prompt or behavior can change the agent's fingerprint, and a change from the baseline raises a drift alert.
• Several dimensions: the fingerprint covers agent intent, delegator context, and operational environment, so an attack that changes one dimension, such as instructions to act as a different workflow, can change the fingerprint even when the other dimensions stay the same.
• Context-bound identity: identity is tied to the agent's context, not only the client connection. On an MCP client connection that carries several contexts, binding identity to context reduces the risk that a compromised context uses permissions granted to a different context.

Agent Interrogation doesn't prevent prompt injection. It adds detection and enforcement at the gateway, alongside the other defenses in your agent stack.

For the drift protection that the HTTP egress proxy provides, see Agent identity and drift protection.

Human-in-the-Loop Approvals (HITL)

Human-in-the-loop approvals pause a sensitive agent tool call, such as deleting records or changing production data, until an admin approves or rejects it. Tool calls that don't require approval run without a pause.

HITL includes per-tool, per-server, and per-trust-level approval policies, an approval queue with batch actions, approval history, a trusted agent bypass for automation, and email and Slack notifications.

For setup, see Human-in-the-loop approvals.

Time-Limited Consent

Time-limited consent sets a consent window that expires. For example, you can give a contractor's agent two weeks of access. When the window closes, the gateway revokes access. If the engagement continues, the user consents again through the standard consent flow.

info

Every plan includes session expiry: a session ends 90 days after the last tool call, and each tool call resets that timer. Enterprise plans add configurable consent windows. See Session expiry.

Agent Verification

Agent verification checks that a connecting agent matches its expected identity and behavior. The gateway builds a profile when the agent connects and uses it to detect changes in the agent's identity or behavior over time.

Agent Interrogation provides the mechanism. The fingerprint from interrogation is the baseline that later connections are compared against.

Session Monitoring

Session monitoring tracks the pattern of tool calls within a session, which gives security reviewers and incident investigators context beyond single calls at the gateway.

With Agent Interrogation, session monitoring compares the intent the agent declared during interrogation with the tool calls it makes, and flags differences for review.

Permission Receipts

A permission receipt is an audit record of a permission grant. It lists who approved the grant, the agent, the MCP server, the tools, the trust level, and when the grant expires. You can export receipts for compliance and governance reviews.

Intent-Based Access Control

Intent-based access control evaluates an agent's declared purpose against policy before the agent starts work, so access checks can consider the whole workflow instead of single tool calls.

Agent Interrogation captures the intent. During the interrogation exchange, the agent declares its purpose and the tools it expects to use, and policy uses the declaration for access decisions.

Feature availability

Feature	Availability	What it covers
Agent Interrogation	Contact Permit	Composite agent identity, fingerprinting, and drift detection
Human-in-the-Loop Approvals	Enterprise	Per-tool, per-server, and per-trust-level approval policies with email and Slack notifications
Time-Limited Consent	Enterprise	Configurable consent windows
Agent Verification	Contact Permit	Identity and behavior checks based on Agent Interrogation
Session Monitoring	Contact Permit	Tool call patterns within a session
Permission Receipts	Contact Permit	Exportable records of permission grants
Intent-Based Access Control	Contact Permit	Policy decisions based on declared intent

For features marked "Contact Permit", schedule a demo or email support@permit.io to confirm availability. You can also ask in the Permit Slack community.

Next steps

• Human-in-the-loop approvals: set up approval policies and notifications.
• Consent Service: how users grant trust and how sessions expire.
• Enterprise deployment: run the gateway in your own infrastructure, with a local PDP, private MCP servers, and data residency.
• Audit logs: review agent activity.