Which MCP Primitive Puts the Model in Control

An MCP server exposes three kinds of capabilities: tools, resources, and prompts. Your team is deciding which of the three deserves the credential-scoping and prompt-injection scrutiny this course applies to MCP servers — scrutiny that matters most for whichever primitive the model itself decides to invoke, constructing its own arguments, rather than something a human explicitly selects or something the host attaches to context automatically.

Which MCP primitive is model-controlled in this sense?