feat(mcp): cap read volume per caller identity

A scope authorises a read and says nothing about volume. An agent reads a
thousand records in seconds where a person clicks ten, and until now nothing
noticed: the token is valid, the tool is permitted, the ACL passes. That gap
stopped being theoretical the day an autonomous run started reading the whole
catalog on a schedule.

identifier: credential keys the counter on the sub claim — the end user,
whoever is asking on their behalf — so an agent looping under one person's
identity spends that person's budget and cannot spend everyone's. Verified on
catalog: pm-user and ro-user hold separate counters.

Per-route namespace, so a busy domain cannot exhaust another's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

Stéphane Tailland

2026-08-29 18:05:50 +02:00

parent de31e0cd39

commit 8573e300e2

4 changed files with 58 additions and 0 deletions

									
										kong/kustomization.yaml
									
		+1
		
												View File
												
				@@ -17,6 +17,7 @@ resources:

				  - mcp/consumergroups.yaml

				  - mcp/ai-mcp-proxy.yaml

				  - mcp/openid-connect.yaml

				  - mcp/rate-limiting.yaml

				  - mcp/audit-log.yaml

				  - mcp/audit-log-body-capture.yaml

				  - mcp/audit-log-body-capture-bindings.yaml