AI agents connected to enterprise systems may be paying to consider tools they cannot use. Okta calls this prompt overhead the “tool tax”: every model request can include names, descriptions, parameters and schemas for all tools exposed through a Model Context Protocol server, even when most are irrelevant or unauthorised.
The identity provider argues that filtering this catalogue before it reaches the model can address two problems at once. A shorter list consumes fewer input tokens, while hiding unauthorised tools reduces the actions available to a compromised identity. The logic is clear, although the evidence so far comes from Okta’s internal modelling rather than a documented customer deployment.
Tool definitions create a recurring prompt cost
MCP servers give agents a standard route to services such as workplace applications and internal data systems. A server may expose a large catalogue, and the model receives a representation of the available tools on each turn so it can decide whether and how to call one.
That representation is not free. Each schema adds tokens before the agent attempts any action. A conventional runtime permission check can reject an unauthorised call, but it cannot recover the tokens already spent showing the model a tool it was never allowed to execute.
Okta says the burden grows with both catalogue size and usage. If many employees repeatedly invoke agents connected to a broad MCP server, the same unused descriptions are processed across large numbers of calls. The company’s modelling indicates that some permission profiles removed more than 90 percent of visible tools, with schema-token costs falling by roughly the same proportion.
No absolute token counts or dollar savings were disclosed. Actual economics depend on schema length, request volume, model pricing, catalogue composition and the distribution of permissions, so the percentage should be treated as a scenario result rather than a universal forecast.
Identity determines what reaches the model
Okta’s proposal narrows access from an entire MCP server to individual tools. An administrator assigns permissions to the agent identity and the user associated with it. The system then returns only the permitted subset when assembling the model’s prompt, followed by another scope check when the agent tries to execute a call.
The design applies least privilege before inference rather than only at the execution boundary. An agent without permission to use a database or administrative action does not see its tool definition. That reduces prompt size and limits the catalogue an attacker could exploit after compromising the identity.
For its model, Okta mapped MCP tools to the OAuth scopes that unlock them and created representative roles, including read-only helpdesk users, helpdesk operators, application administrators, brand and email administrators, and super administrators. It then weighted those segments according to assumed monthly traffic.
This methodology makes the result sensitive to organisational assumptions. A narrowly authorised workforce will show larger reductions than one dominated by privileged users. It also requires an accurate inventory and careful entitlement mapping; stale permissions could make a scoped list misleading or unnecessarily broad.
Cost governance and security converge at the catalogue
Okta distinguishes its approach from AI gateways that meter tokens, impose spending caps, route requests or enforce rate limits. Those controls remain useful, but they generally observe or restrict consumption around the model call. Identity scoping changes the prompt before the cost is incurred.
The mechanisms can therefore complement each other. A gateway can track how much a team spends, while identity governance determines which tools a particular agent and user should consider. Okta’s position is that existing entitlement data provides finer context than a separate group-level budget alone.
The security benefit follows from the same filter. Removing a tool from an identity’s view does not eliminate every agent risk, and runtime authorisation remains necessary. It does reduce the available action surface and prevents the model from reasoning over capabilities outside its role.
Okta has presented a plausible architectural pattern, not production proof of savings or breach prevention. Organisations evaluating it need to measure real schema sizes, traffic and permission distributions, then test whether filtering introduces operational failures. If those checks hold, MCP tool scoping could turn access governance from a final gate into an efficiency control embedded at the beginning of every agent turn.
