Hiya folks,
Quick one this week, prompted by a question someone asked me: “have you seen the new MCP update?” Honest answer: only just. But there’s a bit in there that lands squarely in identity territory, so figured it’s worth a plain-English write-up.
If you’ve never heard of MCP (Model Context Protocol), short version: it’s the open standard that lets AI agents talk to tools and data sources. Think of it as the “how does the AI actually go and do the thing” layer. On 28 July 2026 the protocol got its biggest update since launch. Most of it is plumbing I won’t bore you with. One piece, called MRTR, is basically an identity pattern wearing a new acronym.
The old problem, in plain terms
Before this update, if an AI tool needed to check something with a human mid-task, say “are you sure you want me to delete this?”, the connection between agent and tool had to stay open the whole time just in case. Fine at small scale. Painful once you’re running thousands of these at once. Software equivalent of keeping someone on hold instead of calling them back.
What MRTR actually does
MRTR stands for Multi Round-Trip Requests. Instead of holding the line open, the tool now says “I need an answer before I continue” and hands back what it needs answered. The agent goes off, gets the answer, and comes back with a fresh request that includes it. No holding pattern.
Practically, that’s things like “this is going to cost money, confirm?” or “this query will delete data, you sure?” The AI equivalent of a permission prompt. Roughly, it plays out like this:
Tool -> "Before I do this, can you confirm: delete 40 rows?"
You -> "Yes, go ahead."
Tool -> *finishes the task*Why this is actually an identity story
Strip away the protocol jargon and this is a pattern we already know cold: just-in-time authorization. Ask permission at the point of risk, not before, not as a blanket grant up front. We’ve been doing versions of this for human access for years: step-up auth, access requests, approval workflows. MRTR is that same idea, showing up in how AI agents talk to tools.
There’s a second bit worth mentioning: a companion piece of this update called Enterprise-Managed Authorization (EMA). In plain terms, enterprises got sick of AI tools asking for the same approval over and over. EMA lets an organisation manage consent centrally instead of re-approving the same connection endlessly. Microsoft, Okta, and Anthropic are all named as backers. Tells you this isn’t a fringe idea.
So what does this mean for us?
Nothing urgent to go do. But if you’re in IAM and haven’t been paying attention to how AI agents get authorised to act, this is a decent signal that agent identity and consent is becoming its own design surface. The patterns look a lot like ones we already understand. Worth keeping half an eye on as it matures.
Still very much learning this space myself, so if I’ve oversimplified anything above, happy to be corrected in the comments.
Cheers, PK