The rule. When a product integrates AI through the Model Context Protocol, design by who controls each primitive: prompts are user-controlled, resources are application-controlled, tools are model-controlled, and that third tier needs a consent surface you design on purpose.
Why. The specification defines the three server primitives as a control hierarchy: prompts are interactive templates invoked by user choice, resources are contextual data attached and managed by the client, and tools are functions exposed to the model so it can take actions such as API posts and file writes (Model Context Protocol, 2026a). For tools, the spec reads like an interaction brief: there should always be a human in the loop able to deny an invocation, UI that makes clear which tools the model can see, visual indicators when one runs, and confirmation prompts for operations (Model Context Protocol, 2026b). The same document draws the trust boundary in plain terms: a server's tool annotations must be treated as untrusted unless the server itself is trusted, and tool inputs should be shown to the user before they are sent, because exfiltration can also be an accident (Model Context Protocol, 2026b).
Seen in the wild. Claude's connector permissions ask per tool, and the help documentation tells users to reserve "Allow always" for a server and tool they trust to run unsupervised (Anthropic, n.d.).
Verified as of 2026-08-13 against MCP specification version 2026-07-28.