multiplication

The passage around this formula

That architecture is a specific case of a more general primitive already standardized outside MCP. RFC 9396 defines authorizatio$n_d$etails , an OAuth 2.0 extension letting a client request structured, fine-grained permissions — its own example is the difference between “read access to a profile” and “transfer 45 euros to a named merchant” — instead of the flat, coarse strings that scope provides on its own [ 7 ] . MCP’s step-up scoping is a narrower instance of the same idea: authorization as a set of bounded, named permissions rather than a single yes/no grant. The dual-control key-ceremony rig — two independent credentials, neither sufficient alone, both required before a shared grant…

Read this part in the article →