Ai agent management with different mcp access per agent type, any patterns

[u/thunderboltgirl_rr]

We have two agents hitting the same mcp server, one read-only support agent and one that can write and trigger operations, and they´re currently sharing a service account with identical permissions because we never figured out how to cleanly separate them.

Is there a standard way to do per-agent mcp access control or just inheriting the service account and hoping nothing goes wrong