Short answer: The Context Access Divide is the gap between AI users whose agents can retrieve relevant context from their own files and data automatically, and users who must find and attach the right documents by hand at every prompt. The term comes from a July 2026 arXiv preprint by Masahiro Fujita, a sociologist at Kansai University. The paper argues for broader access to open dynamic retrieval across ecosystems. We agree, with one addition the paper does not address: once an agent can reach your entire corpus on its own, the deciding question becomes who authorizes that reach, for what, and for how long. That is an authorization problem, and most deployments have not solved it.
What does the Context Access Divide paper actually say?
The paper (arXiv 2607.08495, submitted July 9, 2026, a preprint that has not been peer reviewed) extends earlier work on “agentic inequality,” which measured who can access AI agents and at what capability level. Fujita’s point is that two people on the same subscription tier, using the same model, can still get categorically different value from it. What separates them is a single architectural feature: whether the system retrieves context on its own or waits for the user to supply it.
He sorts AI interfaces into three architectures. In the Manual Attachment Model, the user hunts down the relevant files and uploads them at each query. In what he calls Walled dynamic retrieval, the assistant fetches context autonomously but only inside one vendor’s ecosystem, the way Copilot reads your Microsoft 365 documents or Gemini reads your Google Drive. In Open dynamic retrieval, the agent can reach across ecosystems into local files, email, databases, and third-party services, which is what the Model Context Protocol (MCP) enables.
The core argument is that manual attachment fails mathematically as your files accumulate. Drawing on memory research, the paper models how a person’s ability to recall which documents matter degrades as the corpus grows, so for a knowledge worker with twenty years of files, hand-feeding context is not an inconvenience. It is a ceiling on what AI can do for them. Fujita calls the divide a “macro-consequential micro-variable”: a per-interaction design detail whose effects add up to society-level inequality.
What does the paper propose to do about it?
Fujita’s recommendations are aimed at platforms and regulators: transparency about which retrieval architecture a product actually ships, interoperability mandates so platforms support open retrieval protocols, data portability so users can move their corpus without losing retrieval capability, and public procurement standards that favor open architectures. He also names a market dynamic worth remembering: vendors have every incentive to offer capable retrieval inside their walls, because it delivers the user experience while deepening lock-in. Nobody profits from building the open version, so the market under-supplies it.
One thing the paper does not propose, despite how naturally it fits, is any mechanism for user control over what agents retrieve. Its governance instruments are about which architectures exist and who can access them, not about how a specific user authorizes a specific agent to touch a specific slice of their data.
The question the paper leaves open: who authorizes the retrieval?
Take the paper’s prescription seriously and picture the end state. Every knowledge worker has agents with standing, autonomous reach into their email, files, notes, calendars, and third-party accounts. The retrieval problem is solved. The trust problem has just become enormous.
Agents process untrusted input, which means their access can be turned against their owner. In the GitHub MCP incident documented by Invariant Labs in May 2025, a poisoned public issue was enough to make an agent exfiltrate private repository data, using the same token its owner had legitimately configured. The agent did not malfunction. It did exactly what its access allowed, on instructions its owner never gave.
Now look at how retrieval access is actually granted today. Astrix’s 2025 scan of MCP servers found that of those requiring credentials, 53 percent use static API keys or personal access tokens and only 8.5 percent use OAuth at all. The dominant setup behind “autonomous context retrieval” is a broad, long-lived credential in an environment variable that the user configured once and cannot see, limit, or revoke per agent. Expanding retrieval on top of that foundation does not close a divide. It scales an exposure.
This is why we read the Context Access Divide as an authorization problem wearing an inequality costume. The paper is right that autonomous retrieval is the future of useful AI. It is also the reason per-agent, user-controlled authorization stops being optional.
How user-mediated authorization makes open retrieval adoptable
The failure mode in every incident above is the same: the credential lives in an automated channel the agent controls, so whatever manipulates the agent inherits the access. User-mediated authorization (the model AgentAdmit implements, patent pending) removes that channel. The user starts the connection inside the app that holds their data, chooses exactly which scopes to grant and for how long, and receives a single-use connection token themselves. The user hands that token to their agent; the app never delivers a credential to an agent endpoint, webhook, or callback. There is no automated path from “injected prompt” to “new access.”
The result is retrieval an owner can reason about. Each agent holds a scoped, time-limited credential of its own. Every call is validated and logged. Revoking one agent takes one click and does not disturb the others. A read-only research agent can see read endpoints and nothing else. None of this restricts what the paper wants users to have. It is what makes granting that reach a sane decision, in the same way that MCP answers what an agent can do while authorization answers whether this agent, for this user, is allowed to. The approach complements standards like OAuth rather than replacing them; we have documented it in an Internet-Draft submitted to the IETF, draft-emerson-oauth-user-mediated-delivery (a work in progress).
Fujita notes a “configuration gap”: platforms supporting MCP does not mean users experience dynamic retrieval, because setup demands technical sophistication. Authorization design is part of that gap. A consent flow a non-technical user can complete, inspect, and undo is not just safer. It is one of the things that lets the people on the wrong side of the divide actually cross it.
Frequently asked questions
Is the Context Access Divide paper peer reviewed?
No. It is an arXiv preprint (cs.CY, July 2026) by a single author, Masahiro Fujita of Kansai University. That does not make it wrong, but cite it as a preprint, not as settled research.
What is the difference between walled and open dynamic retrieval?
Walled retrieval fetches context autonomously but only within one vendor’s ecosystem, like an assistant that reads your documents inside a single office suite. Open retrieval crosses ecosystem boundaries over open protocols such as MCP, reaching local files, email, and third-party services. The paper argues only the open form serves users whose data lives in many places.
Doesn’t MCP already handle authorization?
MCP specifies authentication for connections, and its 2025-2026 revisions strengthened it. What it does not give you on its own is per-user, per-agent, scoped consent that the data owner controls and can revoke. Authorization is the layer that decides what an authenticated agent is allowed to touch.
Does closing the divide mean giving agents unrestricted access to my data?
No, and it should not. The useful end state is agents with exactly the reach their owner granted: scoped to the task, time-limited, revocable in one step, and logged. Autonomous retrieval and tight authorization are not in tension. The second is what makes the first safe to adopt.
AgentAdmit is the authorization layer for AI agents: user-mediated, scoped, revocable access to the apps that hold your users’ data. See how it works at agentadmit.com.