PRODUCTION SCENARIO
A Generative AI Engineer has an agent that calls a GitHub MCP service registered in Unity Catalog. Calls from the original developer succeed, but the same agent run by a newly onboarded engineer fails with a permission error on every tool call.
What should the administrator grant?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: EXECUTE on the MCP service to the newly onboarded engineer
For an external MCP service registered in Unity Catalog the caller must hold EXECUTE on the service, and AI Gateway checks that permission on every call, so a user without it fails whatever the agent code does. Endpoint or schema privileges do not confer execution, and embedding a token bypasses governance.