---
roles:
  mcp:
    description: Can drive this application through an MCP client, which acts with the credentials the deployment issued rather than the caller's own