AI agents running on the Model Context Protocol (MCP) are the fastest-growing class of non-human identity in the enterprise — and traditional IAM wasn't built for them. 

In this Masterclass, we walk through a complete agentic authorization system: onboarding an MCP server, configuring fine-grained tool-level policies, authenticating an AI agent via OAuth 2.1/OIDC through Duo SSO, and watching access decisions execute in real time based on human user identity. 

To be discussed— OAuth 2.1 token flows, why HTTP 403 breaks MCP clients, the three disconnected authorization layers (network, tool, OAuth scope) and how to unify them.