Eight controls to check
- Identity: require company sign-in before a request reaches the app.
- Access: grant access to a maintained group, not a list copied into code.
- Secrets: block credentials in source and store them outside the container image.
- Ownership: record one accountable person and a backup team.
- Inventory: list the URL, repository, data stores and last use in one registry.
- Logs: keep deploy, access-change and administrative events.
- Offboarding: remove access when Workspace suspends the account.
- Source custody: mirror important tools to a company-owned repository.
Identity belongs at the boundary
Google documents its OpenID Connect endpoints and the hosted-domain claim in the Google OpenID Connect reference. Validate identity before proxying traffic to the tool. Do not ask each tool author to implement OAuth.
Review access as the tool changes
Check the access group when the tool starts handling new data or moves into another team’s workflow. Review dormant tools and tools whose owner left the company. Those two states create more risk than the framework used to build the UI.
Define the data boundary
Write down which systems the tool can read and which ones it can change. Use separate credentials for the tool and grant only the actions it needs. A dashboard may need read access to a reporting database. It should not inherit an administrator token because that token was available during development.
Treat uploaded files, prompts and generated exports as company data. Choose retention rules before the first production use if the tool handles customer, employee or financial records.
Keep evidence for review
IT needs a current inventory more than a one-time approval document. Keep deployment history, ownership changes and access changes with the tool record. Record which source version runs in production and when someone last used the app.
Review tools after an owner leaves, a group changes responsibility or the app gains a new data source. These events give you a concrete review trigger instead of a calendar reminder with no context.
Secure the deployment connector
An MCP connector can perform deployment actions, so treat it as an administrative integration. The MCP authorization specification defines discovery, token and resource requirements for HTTP-based MCP servers.