<Section title="How the term appears in this material">## How the term appears in this material In this channel's material, entitlement system appears once, in Microsoft CTO Kevin Scott's sketch of what agents still need for acting on a user's behalf. Discussing the infrastructure the agentic web requires, Scott lists it alongside agent identities and permission requests directed to both the delegating user and administrators — a bundle of mechanisms for deciding who or what is allowed to do what when an agent takes action. <MomentLink seconds="639"/> [^385ed583-4107-5c5a-b47a-33e1dde27a3b@639] ### An open-community direction, not a shipped product The term arrives with explicit uncertainty. Scott presents entitlement systems as a direction the community could build, openly on top of MCP rather than as something proprietary to Microsoft — and even in his own telling it is still speculative. <MomentLink seconds="632"/> [^385ed583-4107-5c5a-b47a-33e1dde27a3b@639] ### Where it sits in the security picture The related video explores this same space from another angle: Alex Rattray of Stainless argues that limiting what an MCP server exposes is the wrong lever for security, because everything in the underlying API remains reachable under the hood — security must be enforced at the API layer with OAuth granular permissions and proper scopes. <MomentLink seconds="2454"/> [^913c216d-5ccb-51d9-8f42-8feb7c017d9d@2454] An entitlement system, as Scott sketches it, would complement that by giving the ecosystem a way to grant and revoke what agents may do on a user's behalf — a question that grows urgent as interaction shifts from synchronous prompting to asynchronous delegation, where you hand a task off and the agent acts without you in the loop. <MomentLink seconds="1551"/> [^eea0a522-b6b8-5472-bf62-08b0a42ab8a3@1551] </Section> <KeyPoints> - An entitlement system is a mechanism for governing what agents are permitted to do on a user's behalf — who may act, and what actions are allowed. - It appears only in Kevin Scott's forward-looking sketch, alongside agent identities and permission requests to users and administrators. <MomentLink seconds="639"/> - Scott frames it as something the community should build openly on top of MCP, not as a Microsoft-proprietary solution — and as still uncertain. - It complements API-layer security (OAuth scopes) rather than replacing it, and matters most for asynchronous agent delegation. </KeyPoints>