Security & governance
Confused Deputy
A confused deputy is a component tricked into using more authority than a request deserves.
The MCP version runs through a gateway holding one delegated token for several downstream servers.
Forwarding that token unchecked lets the least-trusted server act with permissions the original grant never covered.
The fix is validating that a token names the receiving server, and never forwarding it elsewhere.
← Back to the full glossaryRelated terms
More in Security & governance
Data Processing Agreement (DPA) A DPA is the contract naming a vendor as a processor of personal data. Data Residency Data residency is where data is physically processed and stored, not where users are located. Red Teaming Red teaming is deliberately attacking your own AI system to find what breaks first. AI Register An AI register is a current list of every system that touches a model.