Skip to content

Enterprise-Ready Agentic Workflows: Hardening MCP with Policy-as-Code - DEVNET-2685#

Cisco Live Europe 2026 (Amsterdam) digest Program Core pick Amsterdam · 9–13 February 2026

Abstract

Lori Jakab (Cisco)

  • Why: MCP is spreading into network automation exactly where this PM operates, and its security model is genuinely immature. Applying OPA/Rego to JSON-RPC MCP traffic is a concrete, standards-agnostic pattern — policy-as-Code spanning agents and traditional automation is a real near-term need.
  • What: Why MCP's current authentication mechanisms fall short of enterprise requirements, and how to harden MCP servers with Policy-as-Code: OPA and Rego applied to JSON-RPC messages between MCP clients and servers, unifying access control across agentic workflows and existing API/script-based automation (from abstract only).
  • How: Extend policy enforcement from traditional API payloads to MCP JSON-RPC messages via OPA, with demonstrations including real-world Cisco deployment scenarios.
  • Where applicable: General technique (OPA/Rego are open source; MCP is an open protocol), not locked to Cisco infrastructure — though demos are Cisco-centric. Requires comfort with automation tooling.