Scope MCP Keys to the Human, Not to the Team

The first time a support engineer asked for MCP access so she could pull customer records without bugging the on-call, we handed her a gateway key. The second PM asked for the same thing, we gave him