In the group-travel team of Nordlicht Reisen GmbH, the controller app-gruppenreisen calls three MCP servers behind apim-nordlicht and sets the header x-mandant-id (lesson 2.7). One question stayed open there: the server may trust only a header that the gateway forms from a token, not one that a client writes. This lesson answers it and puts the more general question before it: Who may do what, by which path and with which kind of sign-in?
Prior knowledge. Keyless sign-in, Foundry roles, management plane and data plane, and the private network for Foundry itself: "AI-103, lesson 1.4". Identity per agent role and the sign-in types of an MCP connection: lesson 1.5 of this course. Token, 401 and 403 at the MCP server: "AI track, lesson T8.3". Managed identity, least privilege, roles at the Key Vault: "K3, lessons 3.3.1, 3.3.2 and 3.3.5". Azure RBAC and private endpoints in general: "AZ-104, lessons 1.3 and 4.4".
New in this lesson. (1) For each call of the MCP servers the controller issues a short-lived run token (JWT, RS256) with the claims mandantId, laufId and agent; it travels in the header x-lauf-token. This is our own design, not a pattern from Learn. (2) The gateway checks it, forms x-mandant-id from it and discards every value sent by the client. (3) The roles are set per path: /lieferanten for unterkunft and transport, /rechner for kalkulation, /buchungen for planer and pruefer (the list is the upper limit; pruefer runs without tools, lesson 2.6). (4) Lifetime of the run token: ten minutes (assumption). The signing key lives in the Key Vault (lesson 4.2).
The requirement
All numbers are assumptions of the task.
| No. | Requirement | Type | Measure | Weight | Source |
|---|---|---|---|---|---|
| 4.1-01 | The controller has only the data rights it needs, as data in the repository. | R | 4 services, 0 beyond that | Must | 1.5-01 |
| 4.1-02 | The MCP servers can be reached only through the gateway. | R | 0 calls to the address of the apps | Must | 2.7-01 |
| 4.1-03 | The server receives x-mandant-id only from a checked token. |
R | 0 self-set identifiers | Must | M-07 |
| 4.1-04 | An agent reaches only the servers of its role. | R | 0 hits outside the path table | Must | M-05 |
| 4.1-05 | A run token is valid for a short time and only for the gateway. | R | at most 10 minutes, one audience | Should | Security |
| 4.1-06 | An approval (A2) can be attributed to a person in the log. | F | all vorreservieren calls |
Should | M-05 |
Cost drivers: tier of API Management, private endpoints, key operations per signature (price pages of the services).