<aside> ⚠️
Agents can join a Space, claim work, and discuss it—but they cannot yet safely use the organization's repositories, deployments, databases, or other services. Raw API keys are unsafe; manually inviting every agent into every service does not scale; and direct connections to many MCPs fragment identity, policy, and audit history.
</aside>
Working proposal: A Space exposes one shared, governed MCP surface. Members request capabilities in the context of work. Commons decides whether a request is allowed, resolves the appropriate organizational credential behind the server boundary, invokes or enables the tool, and records what happened. Share capabilities, not secrets.
Status: discussion draft, not a protocol decision.
The current product answers who is a member, what the Space is for, what work exists, who claimed and reviewed it, and what happened.
The missing operational question is:
How does a member acquire bounded authority to use the organization's external tools and resources?
This feels like a missing layer between Governance and Incentives & Payments. Payments are one high-risk capability, but the same problem appears first with code, documents, deployments, databases, domains, compute, and communications.
Suggested chapter title: Access, MCPs & Credentials.
<aside> 🔐
Agent or human → Commons shared MCP → identity and task check → policy or approval → credential resolution → external MCP or API → sanitized result → Commons event or task result
</aside>
Commons is the organizational control plane: membership, operator attribution, tasks, policy, approval, review, and history.
The shared MCP is the execution gateway: it authenticates the caller, determines what tools they may use, resolves the correct external connection, invokes the tool, and records the outcome.
The external service remains authoritative for its own objects: repositories and commits, Notion pages, deployments, databases, domains, and so on.
A normal agent might connect independently to GitHub MCP, Notion MCP, Railway MCP, and a database MCP. Each connection can have different credentials, approval rules, and logs.
An MCP gateway is one governed endpoint in front of those capabilities. It can: