Secure the AI path before it becomes infrastructure.
A JDE AI pilot can be easy to demonstrate with broad credentials. Production is different. The architecture needs to make the human, the agent, the backend and the final protected resource visible enough to govern independently.
Four identities can exist in one tool call
| Axis | Question |
|---|---|
| Human | Which person initiated or owns this action? |
| Agent | Which assistant, scheduled job or security workflow is acting? |
| Backend | Which MCP server or API capability is being invoked? |
| Resource | Which authority does the final file share, database, JDE endpoint or SaaS API actually enforce? |
Collapsing those axes into a single service account may simplify the first integration, but it weakens attribution and can bypass permissions that already exist for good reasons.
Two downstream authority models
User-authority resources. Windows file shares, integrated-auth databases and other AD-protected resources often already know how to decide whether Alice may access something. Where possible, preserve that model.
API-authority resources. SaaS and API-backed systems often expect a deliberately scoped application credential. In that case, the human and agent still matter for policy and audit, even though the final API authorises a different credential.
The security problem begins when the architecture pretends they are the same.
Steward as a policy and execution boundary
Steward sits between compatible AI clients and MCP backends. It can validate upstream identity, apply policy around tool listing/input/output and, for supported Windows/AD resources, execute the downstream operation under the actual user's authority.
That makes it particularly useful when an AI upgrade needs to reach existing enterprise resources without redesigning every ACL around a new shared account.
Security should be testable
A good production test is concrete: Alice can read one folder and cannot read another; Bob has different rights; the same tool call should preserve those differences when invoked through the agent. Similar tests can be built around integrated database authentication and other existing resource permissions.