# Nested Systems Multiply Authorization Decisions ## Claim When agents call servers that call further servers, permission decisions scale as a product of the layers rather than a sum, so a topology that looks small generates a decision count no human can review. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds where each layer requires independent authorization and scopes are not inherited — the MCP-plus-agents case, where servers, agents, and scopes each multiply the others. - Breaks where a single delegated credential carries transitively through the layers, which solves the counting problem by removing the granularity that made it safe in the first place. - The 500-decision figure from the source talk (10 servers × 5 agents × 10 scopes) is a cross-product worst case, not a measurement — treat the mechanism as sound and the magnitude as unverified. ## Evidence The talk's worked example: ten MCP servers, five agents, and ten scopes produce 500 distinct consent decisions under a naive per-layer authorization model — a number that assumes every agent needs every scope on every server, which is the upper bound rather than a typical deployment. ## Links - [[3. Resources/Permanent Notes/Delegated Consent Reduces Burden by Moving Visibility Upstream]] — because extends; this note names the multiplication mechanism that makes delegation necessary, that note evaluates the tradeoff delegation makes in response - [[3. Resources/Permanent Notes/A Declared Capability Costs You Every Turn Not Every Use]] — because contrasts; that note is about a different multiplicative cost (declared capabilities taxing every agent turn), useful for comparing which multiplicative costs in agent systems are addressed versus ignored - [[3. Resources/MOCs/AI Agent Safety MOC]] — because applies-in; authorization-decision scaling is a core agent-safety design constraint ## Tests / falsifiers - Instrument a real agentic deployment and count distinct consent decisions actually required. If sparse permission matrices (most agents needing most scopes) keep the count closer to linear than multiplicative, the framing overstates the problem in practice even if it's mechanistically correct. - If MCP implementations converge on scope inheritance or transitive credentials as the default pattern, the multiplicative-decision problem this note describes becomes rare in practice — worth re-checking as MCP tooling matures. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Full Document Contents/Articles/Navigating the Identity Abyss in the AI‑Native Era - Yuichi Nakamura, Hitachi]] — KubeCon Japan 2026, the consent-explosion worked example and MCP EMA response.