The stable Enterprise-Managed Authorization (EMA) extension for MCP centralizes enterprise access provisioning for AI agent tooling via identity providers. However, EMA only governs connection-level access, leaving runtime per-action authorization entirely to implementers and creating a critical security governance gap for enterprise teams.
The Enterprise-Managed Authorization (EMA) extension for the Model Context Protocol went stable on June 18, 2026, and it fundamentally changes how organizations provision access to AI agent tooling. If you've been tracking MCP's explosive growth — combined Python and TypeScript SDK downloads crossed 97 million monthly by late 2025, per MarkTechPost — you've probably noticed that authentication has been the missing piece preventing enterprise rollouts. EMA fills that gap, but not in the way most teams expect.
Here's the core tension: EMA solves connection provisioning beautifully while leaving runtime authorization entirely to implementers. Understanding where its authority stops is the difference between a secure deployment and a false sense of safety.
The Per-User Problem EMA Replaces
Before EMA, the standard MCP authorization model was per-user and per-server, requiring every employee to manually authorize every server individually.
If you enjoyed this, read the full post at SaaS with Alex
Top comments (0)