In many cases, you can partition data at rest (eg parquet) on the user access key, then load it once into an agent container at runtime. In this way, one authentication pass provides access to all data in a sandbox, versus repeatedly authenticating against MCP calls. It also just reduces the connective tissue between the harness and the data. There are obviously drawbacks in that you aren’t leveraging real time APIs, but it works well for most business use cases.