# How to study for the MCPA security and governance domain

DevFeed: [How to study for the MCPA security and governance domain](<https://devfeed.tech/articles/how-to-study-for-the-mcpa-security-and-governance-domain-31437.md>)

Original publisher: [Read original article](<https://workos.com/blog/mcpa-certification-security-and-governance>)

Author: WorkOS

Published: 2026-09-16T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [audit](<https://devfeed.tech/tags/audit.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [model-context-protocol](<https://devfeed.tech/tags/model-context-protocol.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

A study guide for the security and governance domain of the Model Context Protocol Associate exam. It explains trust boundaries, token audience validation, token handling between MCP servers and upstream APIs, and the distinction between consent and authorization.

## Source excerpt

Security and governance is 24% of the new Model Context Protocol Associate exam. Here is what each competency actually covers in the 2026-07-28 spec, and the distinctions candidates get wrong.