Identity management vendor Okta has put a name to a problem that’s been quietly draining AI agent budgets: the “tool tax.” Every time an agent makes a model call, the prompt includes schemas, names, descriptions, and parameters for every tool an MCP server exposes — not just the ones the agent will actually use. Tokens get burned before any tool execution happens, and a runtime rejection can’t claw them back. It’s a cost problem and a security problem rolled into one.
Okta’s proposed fix is identity-scoped tool filtering. Instead of granting an agent access to an entire MCP server — Google Workspace, Slack, an internal data service — administrators configure which individual tools a specific identity can use. The agent only sees that scoped list in its prompt. Okta then re-checks scope at runtime before any tool call executes. The company’s internal modelling, which mapped Okta MCP Server tools to OAuth scopes and tested representative roles like helpdesk operators and app administrators, found some permission scenarios reduced visible tools by over 90%. Tool-schema token costs fell by roughly the same proportion, though Okta didn’t publish absolute dollar figures.
The comparison Okta draws is between identity entitlements and gateway spending controls. Gateways can meter tokens and cap dollars by key or team, but they’re reactive — they limit costs after a model decision gets expensive. Identity-based scoping is proactive: it determines what the model can even see before the prompt is built. Paul Webber, Principal Cybersecurity Industry Analyst at Okta, frames this as the difference between managing the symptom and managing the input.
Here’s where the skepticism kicks in. Okta didn’t describe a live customer deployment. The evidence comes from internal modelling using Okta product data and public vendor documentation — no customer data. That’s not nothing, but it’s a simulation, not proof. Actual results will vary by tool catalogue, permission distribution, and model choice. Still, the underlying logic is sound and aligns with a broader industry push toward least-privilege access for AI agents. If agents are going to multiply across enterprises, the cost of showing them tools they shouldn’t touch will quickly become untenable.
