18 Authorization for AI agents
The chapter introduces AI agents as a new kind of software actor that can plan dynamically, use tools, revise strategies, and operate across enterprise systems. This flexibility makes them powerful, but it also makes authorization harder than in traditional applications, because it is no longer enough to authenticate who the agent is; the system must govern what the agent is allowed to do at each moment, in each context. The core lesson is that authorization for agents must move from being a static gate at the edge of a system to becoming part of the agent’s runtime decision-making.
To address this, the chapter describes a policy-aware agent loop in which every proposed tool use or action is checked by a policy enforcement point before execution. Requests are evaluated using the familiar principal-action-resource-context model, with the policy engine deciding whether the action is permitted or denied. Denials are not just blocks; they also feed back into the agent’s reasoning, helping it replan. The chapter also shows how policies can do more than stop unsafe behavior: they can define operational boundaries, guide planning through partial evaluation or constraint queries, and reduce trial-and-error by telling the agent what paths are available before it commits to them.
The final sections extend this model to delegation, control-plane protection, and cross-domain cooperation. Agents may delegate work to subagents, but delegation must be explicit, bounded, time-limited, and enforced at runtime so that subagents cannot exceed the authority they were given. The chapter emphasizes that control-plane operations must remain off-limits to agents, even when they can perform useful operational work. It also shows that when authority crosses organizational boundaries, policy alone is not enough: systems need explicit promises, credentials, and reputation to support a practical “society of agents.” Overall, the chapter argues that safe agentic systems require policy to shape behavior, constrain delegation, and preserve control without eliminating flexibility.
Authorization during agent tool invocation. When an agent invokes a tool or command, the request passes through a policy enforcement point. The enforcement point asks the Policy Decision Point whether the action is permitted before the tool executes.
A policy-aware agent loop. An agent iteratively plans and executes actions while a PEP evaluates each proposed action before execution. Authorization decisions become part of the agent’s feedback loop, allowing it to revise its plan when an action is denied.
Policy constraints guiding agent planning. During planning, the agent queries the policy system with a partial request. The policy engine returns constraints, such as permitted actions or accessible resources, that the agent incorporates into its plan. Each action is still evaluated at execution time to ensure consistent enforcement.
Policy enforcement for delegated agents. When a primary agent delegates work, a delegation record defines the scope of authority. When a subagent invokes a tool, the policy enforcement point includes the delegation data in the authorization request. The policy engine evaluates both the request and the delegation constraints before returning a decision.
Cross-domain delegation in a society of agents. Two policy-limited agents collaborate across domains. The receiving agent makes promises about its future behavior, and the requesting agent assesses those promises and the partner’s reputation and then grants authority using a credential. The receiving agent operates under its own policies, and both domains log the outcome for future decisions.
Summary
- AI agents introduce a new authorization challenge because they dynamically plan actions and interact with many systems during execution.
- Authentication alone cannot govern agent behavior because it verifies identity but does not constrain what actions an agent may attempt.
- Policy-aware agent loops integrate authorization directly into the agent’s planning and execution cycle, ensuring that each action is evaluated against policy at runtime.
- Policies can serve as both enforcement gates and constraint systems that guide agent planning using techniques such as Cedar’s typed partial evaluation.
- Separating operational actions from control-plane operations helps protect the systems that define workflows, infrastructure, and authorization rules.
- Delegation allows agents to distribute work among specialized subagents, while policies ensure that delegated authority remains within defined limits.
- Cross-domain delegation requires additional mechanisms, including policies, promises, credentials, and reputation, to enable cooperation between independent systems.
- Verifiable credentials can transport delegated authority across organizational boundaries, while local policies still determine whether specific actions are permitted.
- A society of agents emerges when independent systems interact under shared agreements, using policies to enforce behavior, promises to communicate intent, and reputation to evaluate past outcomes.
Authorization in Action ebook for free
