NEOMSA has introduced a framework for managing AI agent access to internal APIs using the Model Context Protocol (MCP). The system shifts the focus from standard authentication to granular control over specific actions, parameters, and data access levels.
The NEOMSA APIM platform implements this through MCP server publications, consumer applications, and subscription management. Administrators can select specific operations for each server, such as reading client records or modifying credit limits, rather than granting broad access.
Access rights are further refined using scopes, which restrict interactions with specific business objects, organizations, and fields. The architecture also includes audit mechanisms to track agent activity and reconstruct action chains during security investigations.
For sensitive operations, the platform requires explicit confirmation, while execution components must prevent duplicate requests. The system supports multiple revocation methods, including token blocking, credential rotation, scope removal, or disabling application subscriptions.
