Barndoor has written a gating plan for Okta’s open-source MCP server, which lets agents run Okta management operations through Okta’s Admin Management APIs. The post walks the real server. Each tool maps to a minimum OAuth scope, and tools you have not granted are removed at startup, so granting only .read scopes gives you a native read-only mode. The gap is that scopes work per scope, not per tool: okta.groups.manage unlocks group membership changes and group deletion together. Barndoor’s line for it: “OAuth scopes limit which API the agent can call. They don’t describe intent.”
There are no vendor figures here, and the analysis checks out against the server as described. Its three risks are the ones that make an identity provider different from a CRM: privilege escalation through group membership, persistence through changes that survive a password reset, and accountability diffusion, because the Okta System Log records the client, not the person who asked or the prompt that drove the action. The plan allows read lookups with redaction, holds lifecycle and membership changes for a named approver, and denies every policy write, and it tells you to deny admin role grants and token creation by name even though the server does not expose them yet. “An agent should never be able to change the rules that govern agents.” The pitch is implicit: the hold and the log need something in the path, and Barndoor sells that.
The catalog shows what Barndoor ships for it. Barndoor has 13 API pages. The Barndoor Policies API is where the allow-hold-deny buckets would live, the Barndoor MCP Proxy API is the runtime path every call would cross, the Barndoor Agents API registers the agents the post wants identified, and the Barndoor Connections API brokers the OAuth connections to systems like Okta. The agentic access profile records 26 operations: 13 acting, one human-in-the-loop.
The measurement puts the tension on accountability. Barndoor holds a Kin Score of 54.7, strong, with discoverability at 75.0 and contract governance at 27.3. Agent Readiness is 34.8, agent-ready: the MCP server, auth clarity, error semantics and OpenAPI examples are lit. Delegated identity is unlit, and so is consent identity. That is the gap the post is most persuasive about, an action that cannot be traced back to the person who asked for it. One human-in-the-loop operation out of 26 is the catalog’s count of the hold bucket on Barndoor’s own surface. The plan for Okta is sound. Barndoor’s own contracts do not yet describe whose authority an agent is acting on.