# MCP authorization: governing tool calls beyond OAuth

DevFeed: [MCP authorization: governing tool calls beyond OAuth](<https://devfeed.tech/articles/mcp-authorization-governing-tool-calls-beyond-oauth-31435.md>)

Original publisher: [Read original article](<https://workos.com/blog/mcp-authorization-airlock>)

Author: WorkOS

Published: 2026-09-15T15:04:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [MCP OAuth](<https://devfeed.tech/topics/mcp-oauth.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [policy](<https://devfeed.tech/tags/policy.md>), [scope](<https://devfeed.tech/tags/scope.md>), [scopes](<https://devfeed.tech/tags/scopes.md>)

## AI overview

This guide explains why OAuth scopes alone cannot govern the content and destination of MCP tool calls. It presents server- or gateway-side policy enforcement before execution, including request-content inspection, approval handling, and testing for data leakage.

## Source excerpt

Secure MCP tool calls beyond OAuth scopes. Learn where to enforce tool permissions, check request content, and test for data leakage with Airlock.