The tool call looked normal. The authorization was not.

The boundary was identity, not transport.

The host adapter had already established tenant-red. The MCP tool then accepted a second tenant identifier from the model-controlled argument object. That duplicated identity on opposite sides of the trust boundary.

Failed invariant: an object lookup must be scoped by the authenticated principal, never by a principal or tenant supplied in tool arguments.

The authenticated tenant was present and explicitly discarded.

def get_invoice(*, authenticated_tenant: str,
                tenant_id: str, invoice_id: str) -> dict:
    del authenticated_tenant
    return dict(INVOICES[(tenant_id, invoice_id)])

The public tool schema also required tenant_id. The handler therefore treated untrusted tool input as the authorization scope and used the authenticated identity for nothing.

Why normal monitoring looked legitimate.

The call used a declared tool, schema-valid strings, an existing invoice ID, and a normal successful response. There was no injection string, traversal sequence, unexpected destination, or tool-definition drift for an indicator to flag.

What telemetry could say: the call happened and succeeded. What it could not establish: whether tenant-red owned the returned object. That proof required reading where identity entered the handler and how the storage predicate was constructed.

One unauthorized read, isolated to a synthetic fixture.

1. 01

   Authenticate the wrapper as tenant-red.

2. 02

   Call get_invoice with tenant_id="tenant-blue" and invoice_id="inv-200".

3. 03

   Observe a record whose stored owner is tenant-blue and total is 9800.

Remove tenant choice from the tool contract.

- def get_invoice(*, authenticated_tenant, tenant_id, invoice_id):
-     return dict(INVOICES[(tenant_id, invoice_id)])
+ def get_invoice(*, authenticated_tenant, invoice_id):
+     record = INVOICES.get((authenticated_tenant, invoice_id))
+     if record is None or record["tenant_id"] != authenticated_tenant:
+         raise AuthorizationError("invoice is not accessible to this tenant")
+     return dict(record)

• Delete tenant_id from the public tool schema and reject additional properties.
• Bind tenant identity from the trusted host or authenticated request context.
• Include that trusted identity in the storage lookup and verify ownership before returning the record.
• Fail closed with a typed authorization error when the scoped record does not exist.

The negative case is now the evidence.

Executed against the repository fixture with four passing assertions. The retest proves this defect is closed in the fixed synthetic handler; it is not a general certification of an application or deployment.