The three actors
The AI client starts a request, the authorisation service confirms the athlete and grant, and the Bulk Coach resource server executes an allowed training tool. The model does not receive database access.
Why a tool is different from a prompt
A prompt can contain a pasted summary that becomes stale. A tool can request the current permitted record, return structured output and apply server validation before a supported write.
The permission model matters
MCP standardises discovery and calls; it does not remove the need for authentication, least privilege, consent, logging and revocation. Health access should not be bundled into ordinary workout access.