AI Agent Authorization
Why authorization built for stateless API calls breaks down for AI agents, what a sufficient model actually needs, and a concrete architecture that implements it.
AI agent authorization is the set of checks that decide whether a specific action an agent is about to take is actually permitted — accounting for who the agent is, what task it was delegated, what it has already done in the session, and whether this action combined with prior ones produces a safe outcome. It differs from ordinary API authorization in exactly that last dimension: agents act across multiple steps and multiple tools, so a check that only looks at one action at a time misses an entire class of failure.
Why Per-Request Checks Break Down
A stateless, per-request authorization check evaluates each action as if it were the only one that mattered.
That model works well for a traditional API: each call is authorized on its own merits, independent of what came before. It breaks down the moment an actor executes a multi-step task with tools, because the actor's history now matters. An agent authorized to read confidential documents and, separately, authorized to send external email, violates no individual permission by doing both in the same session — yet the combination is data exfiltration. No per-action check catches that, because no single action is the problem.
The same gap shows up with delegation. When a task passes from a human to an orchestrator to sub-agents and tools, each hop needs its own authorization decision — and if that decision doesn't account for what the parent was actually authorized to do, a sub-agent can end up with more authority than the task requires, or than its delegator ever had.
What a Sufficient Model Needs
Identity across the chain
Every acting agent, sub-agent, and tool is bound to a verifiable identity — not a shared service account reused across every hop.
Scope that narrows, not expands
Delegating a task should never grant more authority than the delegator had. Restrictions can only accumulate as authority passes downstream.
Awareness of composition
A proposed action is checked against what the session has already done, not evaluated as if it were the first and only action of the task.
Quantitative budgets
Ceilings on delegation depth, irreversible effects, cross-domain composition, and cost, so a compromised or misbehaving agent has a bounded ceiling regardless of how many individual checks it passes.
Evidence
Every admitted action is coupled to a record of why it was allowed — the identity, the scope, the checks that ran — or it doesn't execute.
Intent binding
Scope defines what an agent may technically do; intent defines what the delegated task actually requires. The gap between them is where a lot of damage happens without ever crossing a permission boundary.
Complementing, Not Replacing, IAM
None of this replaces OAuth/OIDC, IAM, or policy engines like OPA. Those answer "is this identity authorized for this action right now?" and make that decision programmable and auditable — foundational, and still necessary. What agent authorization adds is the dimension those systems weren't built to cover: authority that has to narrow correctly through a delegation chain, and a decision that has to account for accumulated session state and action composition, not just the action in front of it.
A Concrete Architecture
In Bounded Agents: Delegation Security for Multi-Agent AI Systems, I introduce the Agentic Principal Chain (APC): six deterministic checks — identity binding, scope and composition, session binding, approval binding, evidence commitment, and intent binding — enforced by infrastructure outside the model before any action executes. If any one fails, the action is denied.
The paper proves two formal properties (blast radius monotonicity and composition soundness) and validates them across 3,154 evaluation instances on AgentDojo, InjecAgent, and ASB, including a compromised-model methodology that assumes full model compromise rather than relying on the model resisting manipulation.
Frequently Asked Questions
What is AI agent authorization?
AI agent authorization is the set of checks that decide whether a specific action an AI agent is about to take is actually allowed — not just whether the agent's identity has some permission in the abstract, but whether this action, with these parameters, in this session, given what the agent has already done, should be permitted to execute. It's the layer that determines how much damage a manipulated or misbehaving agent can actually cause.
Why is per-request authorization insufficient for AI agents?
Per-request authorization evaluates each action independently, the same way a traditional API authorization check does. That works when actions are genuinely independent. It doesn't work for an agent executing a multi-step task: an agent authorized to read confidential documents and, separately, authorized to send external email violates no individual permission by doing both in the same session — yet the combination is data exfiltration. The check has to account for accumulated session state, not just the action in isolation.
How should AI agents delegate authority to sub-agents?
Authority should only narrow as it's delegated, never expand: a sub-agent's scope is the intersection of its own declared task and whatever its delegating parent was permitted to do, with any restrictions the parent already had staying in force. Quantitative budgets — delegation depth, blast radius, irreversible effects — should be carried through the chain too, so a sub-agent several hops deep is bounded by the tightest constraint anywhere along that chain, not just its own local configuration.
How does AI agent authorization relate to OAuth, IAM, or OPA?
It complements them rather than replacing them. OAuth/OIDC and IAM answer "is this identity authorized for this action right now?" and policy engines like OPA make that decision programmable. What agent authorization adds is state: evaluating a proposed action against what has already happened in the session, how authority has narrowed through delegation, and whether the combination of this action with prior ones is safe — dimensions that a stateless, per-request policy check doesn't cover on its own.
Can authorization reduce the impact of prompt injection?
Yes, specifically the impact, not the occurrence. Authorization enforced by infrastructure outside the model doesn't detect or prevent an injected instruction — it bounds what a manipulated agent is allowed to execute even if it fully complies with that instruction. If the agent's scope, budget, and composition restrictions don't permit the action the injection is trying to trigger, the injection fails operationally regardless of whether the model followed it.
What is a concrete architecture for this?
The Agentic Principal Chain (APC), introduced in my paper Bounded Agents: Delegation Security for Multi-Agent AI Systems, is one answer: six deterministic checks — identity binding, scope and composition, session binding, approval binding, evidence commitment, and intent binding — enforced outside the model before any action executes, with formal properties (blast radius monotonicity, composition soundness) proven and validated across 3,154 evaluation instances.