Rupert Marais has built a career navigating the intricate intersections of endpoint security and network management, making him a leading voice in the current evolution of AI-driven enterprise systems. As organizations rush to deploy autonomous AI agents, the hidden operational costs and security vulnerabilities of these technologies are becoming increasingly apparent. In this conversation, we explore the “tool tax” and how identity-based scoping is redefining the way companies manage the interaction between large language models and the data environments they inhabit. We delve into the mechanics of filtering tool sets, the importance of least-privilege access in an agentic world, and the strategic differences between identity entitlements and traditional gateway controls.
How does the constant inclusion of tool schemas and descriptions in every model call impact operational budgets?
The financial burden here is what we call the “tool tax,” and it is much more aggressive than most stakeholders realize because it hits you before any work is actually done. Every time an AI agent makes a call to a model, it carries a heavy backpack of metadata—schemas, tool names, descriptions, and specific parameters—for every single tool exposed by a Model Context Protocol server. This means you are paying for the model to “think” about tools it might never even use in that specific session. Our internal modeling shows that this prompt overhead compounds significantly across thousands of users, and because models charge per token, you’re essentially bleeding money on descriptions for databases or Slack connections that the agent doesn’t need for the task at hand. When you consider that a later rejection of an unauthorized request doesn’t give you those tokens back, the waste is permanent and frustratingly linear in its growth.
Could you walk us through the mechanics of how filtering tool lists before they reach the model actually works to mitigate these costs?
The core of the strategy is to shift the control from a broad server-level access to a much more granular, tool-level identity check. Instead of giving an agent a giant catalog of every tool available on an MCP server, an administrator uses a dashboard to configure a scoped tool set based on the specific identity of the agent or the user behind it. When the agent initiates a prompt, the system intercepts the request and only returns the tools that the identity is expressly authorized to see. Our internal tests, which utilized OAuth scopes to map out representative user segments like helpdesk operators or email administrators, demonstrated that we could reduce the number of visible tools by more than 90% in certain scenarios. By shrinking the list before the prompt is even built, the model receives a much leaner input, which directly drops the token count and the associated costs by roughly that same 90% margin.
What are the security implications of this approach, specifically regarding the “blast radius” of a compromised agent?
From a security standpoint, if you aren’t filtering these tools, you are essentially providing a roadmap of your entire infrastructure to any agent, authorized or not. If an identity is compromised, an attacker could potentially see and attempt to trigger actions across a wide range of sensitive databases and internal systems because those tools were visible in the initial prompt. By implementing a least-privilege model at the tool level, we ensure that an agent isn’t even aware of the existence of resources it doesn’t have the right to touch. We verify these scopes at two critical points: first when the tool list is assembled for the prompt, and again at runtime before any execution takes place. This significantly limits the blast radius, as the “exposed” surface area is restricted only to the few tools that were associated with that specific identity’s OAuth scopes.
How do identity-based entitlements offer a different strategic value compared to traditional gateway spending controls?
Traditional gateways act as a necessary safety net, allowing organizations to cap spending by key or team and handle things like rate limiting or routing. They are excellent at metering tokens as they enter or leave the system, but they are often reactive—they tell you how much you’ve spent or stop you after a certain threshold is hit. Identity-based scoping is proactive and much more surgical because it leverages existing entitlement data to determine what should be allowed in the first place. As industry analysts like Paul Webber have noted, using identity governance for cost control is elegant because it doesn’t disrupt business processes; it simply ensures the model isn’t being fed unnecessary data. By filtering the available tool set before it even reaches the metering layer, we are solving the cost problem at the source rather than just monitoring the symptoms at the gate.
What is your forecast for the future of AI agent governance within the enterprise?
I believe we are moving toward a reality where the “identity” of an AI agent will be treated with the same rigor and granular control as a human executive’s credentials. We will see a shift away from broad API access toward highly dynamic, context-aware permissions where tool visibility changes in real-time based on the specific task and the user’s current security posture. Organizations that fail to adopt this “identity-first” approach will find themselves buried under a “tool tax” that makes AI deployments economically unviable, while also facing an unmanageable security surface area. In the next few years, the integration of OAuth scopes directly into the model’s context window will become the standard for any secure agentic enterprise, ensuring that every token spent and every action taken is both cost-efficient and strictly authorized.
