The PropelAuth deep dive is a reminder that MCP cannot stay at the level of convenient tool calls. Once an agent can reach real user data or production systems, the protocol needs a clear authorization story: who is the user, who is the client, what is the server allowed to do, and which resource scopes are in play.
That matters because agent workflows blur boundaries. A human asks a client to use a server to call another service, often with context that looks like intent rather than a traditional UI action. OAuth gives the ecosystem a vocabulary for consent, delegation, token handling, and revocation, but the details have to fit agent behavior.
The security question is not abstract. If MCP servers become the connective tissue between agents and SaaS systems, then authorization bugs become workflow bugs. The wrong token, scope, or tenant boundary can turn a helpful tool into an unsafe bridge.
For New Runtime, this is another sign that agent protocols are becoming infrastructure. The winning protocol surface is not just extensible. It is auditable, bounded, and understandable when something goes wrong.