Identity and permissions: AI Agents / MCP

Source: deck slide 8 · WPP Pilot assessment | Risks #3, #4, #15, #17

Legend: Today = Wrike capability | Confirm = setup/evidence | Pilot = proposed control. See the overview for all labels.

#3 Permissions & Identity · #15 Tool Misuse#

Excess access; unintended actions.

Wrike AI Agents

• Today: Permissions limit who can create agents, and each agent has a selected location.
• Pilot: Give creation rights only to approved Pilot builders.

Wrike MCP

• Today: Wrike access follows the authenticated user.
• Confirm: Check that middleware scope and assistant tool settings keep access within the approved use case.

#4 MCP Security#

Weak authentication or token misuse.

Wrike AI Agents

n/a

Wrike MCP

• Today: OAuth 2.0 authenticates the connection.
• Confirm: WPP shows how its setup issues, expires, rotates and revokes the tokens used for MCP access.

#17 Identity Propagation#

Identity misuse across systems.

Wrike AI Agents

n/a

Wrike MCP

• Today: MCP calls use an authenticated user context.
• Confirm: Check whose identity reaches Wrike, what access is delegated and that shared accounts are avoided.

Related pages#

• MCP connections: approved apps and accounts covers #3 and #4 at the OAuth/API application level.
• The user-type permission screenshot is on Governance: ownership and visibility.

Discussion log#