TRACE: Threat-Relative Ablative Control Evaluation at the MCP Agent-to-Tool Boundary — Closing the Governance Gap Between ISO/IEC 42001 and ISO/IEC 27090

Model Context Protocol (MCP) architectures have become the dominant pattern for deploying agentic AI systems, yet the boundary between agent and tool has no minimum technical control set: ISO/IEC 42001:2023 requires auditable control evidence without specifying what a boundary control looks like, and ISO/IEC 27090 names the threats without prescribing mitigations. The deeper difficulty is methodological — a control set is only as valid as the threat model it has been tested against. This paper's primary contribution is therefore a method, TRACE (Threat-Relative Ablative Control Evaluation): declare the threat model, derive candidate controls, build a real implementation and a real adversary, ablate each control to measure necessity and sufficiency, record the outcome in a control coverage matrix, then expand the threat model and repeat. As TRACE's worked instance we derive seven boundary controls, each an auditable requirement. Against indirect prompt injection (T1) every control is necessary and sufficient — disabling deterministic routing alone caused six real tool calls derived entirely from injected web content. Four further threat models (supply chain, compositional flow, anti-forensics, multi-agent delegation) show where a fixed set falls out of scope, and the four resulting forward controls are built and re-ablated to qualified holds with stated boundaries. What endures is the method and the matrix: an honest record of assessment scope suitable for a 42001-aligned audit. Edition 1. The TRACE reference implementation and the adversarial testbed used for the ablations are the author's own.