MCP Gateway Authorization — As-Built Topology

flowchart TB
  HRIS["HRIS → IGA → ITSM gate
onboarding drives AD"]
  subgraph SOT["AD on-prem — source of truth"]
    ADG["Users + 17 SG-* groups
in an AD OU · tiered T0–T4"]
  end
  subgraph PROXY["The auth-proxy host — two sync engines, side by side"]
    ECN["Entra Connect
AD users+groups → Entra"]
    DDS["AD Duo Auth Proxy
Duo Directory Sync · [ADDS]"]
  end
  ENT["Entra tenant"]
  DUO["Duo directory
AD-synced groups (incl. 17 SG-*)"]
  subgraph PAC["Policy-as-code · SSOT"]
    INT["mcp-authz-intent.yaml"]-->RND["the policy renderer"]
  end
  subgraph PDP["Decision · Duo cloud Authorization API (true PDP)"]
    DAC["ext_authz connectors
agentgw + envoy · LIVE"]
    CSA["Cisco Secure Access
managed SSE · PLANNED"]
  end
  subgraph PEP["Enforcement · gateways (PEP) — one job each"]
    AGW["agentgateway · LIVE
MCP tools"]
    ENV["Envoy AI Gateway · LIVE
LLM providers"]
    SAG["Cisco Secure Access
private apps (ZTNA) · PLANNED"]
  end
  subgraph RES["Resources"]
    MCP["MCP servers
github · ms-learn · splunk"]
    LLM["LLM providers
Anthropic · OpenAI · Ollama"]
    APPS["Private apps
-lite consoles + fabric API"]
  end
  HRIS-->ADG
  ADG-->|Entra path|ECN-->ENT
  ADG-->|AD→Duo path · SG-* groups|DDS-->DUO
  ENT-.->|Entra→Duo sync|DUO
  DUO-->DAC
  ENT-.->CSA
  RND-->DAC
  RND-->CSA
  DAC-->AGW
  DAC-->ENV
  CSA-->SAG
  AGW-->MCP
  ENV-->LLM
  SAG-->APPS
  LEAVER["HRIS leaver → IGA → SSF/CAEP session revoke"]-.->|pulls token|AGW
  LEAVER-.->ENV
  LEAVER-.->SAG
  

The plane, end to end

Source of truth → sync → decision (PDP) → enforcement (PEP) → resources. Policy-as-code drives the PDPs; the leaver signal pulls tokens back out.

Per-tool-call decision

Two checks on every call: authenticate the Duo JWT, then authorize the tool against the sponsor's groups. Default-deny.

sequenceDiagram
  participant C as Agent / MCP client
  participant G as Gateway (PEP)
  participant D as Duo Authorization Connector (PDP)
  C->>G: tools/call (Bearer Duo JWT)
  G->>G: mcpAuthentication — validate iss/aud/JWKS
  G->>D: ext_authz Check (token + target_tool)
  D->>D: sponsor groups ∩ allowedTools(group, server)
  alt authorized
    D-->>G: ALLOW (allowedTools)
    G-->>C: tool result
  else not in any group's bundle
    D-->>G: DENY
    G-->>C: 403 (tool hidden / refused)
  end
  

The 17 groups (net-new, deployed to ADUC)

← conceptual: Agentic AI Gateways & Access (page 5)

Lane: personal lab · synthetic data — reference architecture over synthetic identities only, no customer data.