Ask HN: How are you managing connections/authZ for Cursor/Windsurf?

I'm exploring hooking up various internal tools/datastores (think Postgres, the on-call tool etc.) to Cursor via MCPs.

One recurring problem I'm facing is managing and enforcing employee-level ACLs to these tools via Cursor the same way they are managed/enforced outside.

Say an employee has limited read access to a table in Postgres containing support tickets, I want them to have the same level of access when accessing that table via Cursor.

Seems like running company-wide instances of remote MCP servers is a start. Is anyone solving the user management and permissions problem for the AI-powered IDE space?