The interesting part of the Enterprise-Managed Authorization extension isn’t the OAuth plumbing — it’s the admission that per-user consent was quietly strangling MCP adoption inside companies.

In production, the bottleneck on agent tool use is rarely the model or the protocol. It’s that every employee had to authorize every server individually, security teams had no central audit trail, and personal accounts kept blurring into work tools. The data and tools were already there; the per-user authorization tax kept most of them switched off. That matches what I see across enterprise AI deployments — capability is cheap, governance is the wall.

EMA moves the decision to the org’s identity provider. The client pulls an Identity Assertion JWT (ID-JAG) during SSO and exchanges it for an MCP server access token, with no per-server consent screen and access scoped to the groups and roles a user already has. Authorize once, inherit everywhere, and the audit trail lives in the IdP admin console where compliance can actually reach it.

What I like is that this reframes MCP from “consumer tool connector” into something a security team can reason about. The honest tradeoff is centralization: once the IdP becomes the authoritative decision-maker for what agents can touch, your blast radius and your single point of failure are the same console. The HN thread is already poking at exactly that.

Adoption by Anthropic, Microsoft, and Okta suggests this becomes the default enterprise path within a couple of quarters. The open question for anyone running an agent platform: does centralized, role-scoped tool access actually shrink the attack surface, or does it just relocate consent fatigue from the user to the policy admin who now has to model every group’s tool needs up front?