What shipped
MCP shipped something called Enterprise-Managed Authorization (EMA) on July 6th, and it went stable fast — Anthropic, Microsoft, and Okta are already using it.
The problem it fixes is one anyone running MCP servers at scale has probably hit: every user has to approve every server individually, and re-approve it when tokens expire. Multiply that by a few dozen servers and a few hundred employees and you get a genuine mess.
EMA moves that decision up to the identity provider. Sign in once through your company's IdP, and you're automatically trusted for every MCP server your org has already approved. Technically it works through an Identity Assertion JWT Authorization Grant — the server's auth layer trades that identity assertion for an access token, so there's no more per-user consent screen to click through.
Where this connects to NexusIQ
When I first read the announcement, I assumed this was going to overlap with the governance work I did in NexusIQ. It doesn't, and that took me a minute to appreciate.
EMA only answers one question: can this person's client talk to this server at all. It says nothing about what happens next. Whether a specific user should see a specific row of data, or whether their query should be allowed to touch a particular table — that's still entirely on you to build. The spec is upfront about this, which I respected.
That's exactly the gap NexusIQ's governance engine fills. RBAC and row-level security don't care how the connection got approved — they care about what happens the moment a query lands. So EMA and per-action governance aren't competing; one's a bouncer at the door, the other's watching what you do once you're inside. If you're building MCP tooling for an enterprise, don't let EMA give you a false sense that the governance problem is solved.