---
title: Security, governance, and administrative controls (early access)
description: Apply security, governance, and least-privilege controls when connecting the PingOne Remote MCP Server to AI clients and agents.
component: build-with-ai
page_id: build-with-ai:pingone-mcp-server:p1-security
canonical_url: https://developer.pingidentity.com/build-with-ai/pingone-mcp-server/p1-security.html
llms_txt: https://developer.pingidentity.com/build-with-ai/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-12
keywords: ["MCP", "AI", "PingOne", "Model Context Protocol", "identity orchestration"]
section_ids:
  server-enablement-and-default-state: Server enablement and default state
  tool-exposure-and-production-usage-policy: Tool exposure and production usage policy
  execution-boundaries-and-token-isolation: Execution boundaries and token isolation
  auditability-and-siem-logging: Auditability and SIEM logging
---

# Security, governance, and administrative controls (early access)

The PingOne Remote MCP Server gives an artificial intelligence (AI) client access to information and actions within your PingOne environment. Tool outputs are returned to your AI client and might be included in prompts sent to a large language model (LLM) provider. As a result, use the remote MCP server only with trusted MCP clients, trusted AI agents, and approved AI endpoints. For general disclaimers on AI-generated output, refer to [Disclaimers and Limitations](../disclaimers.html).

* **Use Trusted Clients and Agents:** Only connect the PingOne Remote MCP Server to MCP clients and AI agents that your organization explicitly trusts. Any data returned by MCP tools can be exposed to the underlying AI system, including configuration details and environment metadata.

* **Protect Sensitive Data:** Before enabling the remote MCP server in a given environment, evaluate the sensitivity of that environment's data. Tool outputs might contain configuration information, application settings, identity details, and other administrative metadata that could be transmitted to an external AI provider as part of the client workflow.

## Server enablement and default state

* **Disabled by Default:** The PingOne Remote MCP Server is turned off by default across all environments.

* **Environment-Level Scope:** Enablement is explicitly controlled on a per-environment basis within the PingOne admin console or using the PingOne Management APIs.

* **Human Administrator Required:** AI agents don't have access to any MCP tools capable of modifying MCP server settings or administrative permissions. Enabling or disabling the MCP server requires a human administrator operating directly in the PingOne admin console or using the management APIs.

## Tool exposure and production usage policy

* **Environment Tool Exposure:** When the MCP server is enabled for an environment, all supported read, write, and delete tools for that environment become active. The tools available to an AI session are strictly constrained by the administrative roles assigned to the authenticated user account (for example, Environment Admin, DaVinci Admin).

* **Production Recommendation:** Because enabling the server exposes all available read, write, and delete tools for that environment, use of the PingOne Remote MCP Server against production environments is currently not recommended.

* **Granular Tool Controls:** Granular tool controls will be available in a future release.

## Execution boundaries and token isolation

* **Token Isolation:** The OAuth 2.0 access token resides exclusively within the client transport layer. It is never passed to, accessible by, or readable within the LLM prompt context.

* **Execution Boundary:** The AI agent operates strictly by generating structured JSON tool calls. It can't make arbitrary direct HTTP requests to PingOne REST endpoints or alter its token permissions. If a tool doesn't exist or isn't exposed, the agent has no technical mechanism to execute that action.

## Auditability and SIEM logging

* **Auditability:** All write and sensitive (read: secret) operations executed through the MCP server are recorded in the PingOne audit event stream with dual-context attribution:

  * User Context (`user_id`): The individual human administrator who authenticated the session.

  * Client Context (`client_id`): The dedicated platform client ID (`pingone-mcp-server`).

* **SIEM Logging:** Security information and event management (SIEM) operations teams can filter SIEM logs by `client_id == pingone-mcp-server` to isolate, baseline, and monitor all AI-assisted administrative activity across tenants.