Authorize The Action, Not Just The Agent
By 2028, a quarter of enterprise security breaches will trace back to AI agent abuse, according to Gartner, as traditional identity-based security models fail to address runtime decision-making.
Traditional three-tier application security models are becoming obsolete as AI agents operate with unprecedented autonomy. Unlike human users who follow predetermined paths, AI agents make runtime decisions about which tools, subagents, and APIs to use, often through shared service accounts that obscure the original requestor and purpose.
The fundamental problem lies in organizational silos between identity teams and data teams. Identity teams know who the agent is, while data teams understand what data is allowed for what purposes, but they rarely coordinate on a unified decision framework. This gap creates vulnerabilities that malicious actors increasingly exploit through prompt injection and other attack vectors.
Action-Based Authorization
The solution requires shifting from session-based to action-based authorization, where each individual tool call or query receives its own security decision. This approach evaluates who initiated the action, on whose authority, what the specific job entails, and whether the requested data aligns with its permitted uses.
Identity is where authorization starts, just not where it ends anymore. With agents, the question has moved from who you are to what you're doing, and whether the data you're about to touch was ever meant for that.
Practical Implementation
Effective implementation begins by extracting intent from immutable sources like the original request or workflow step, rather than trusting the agent's self-reported purpose. Policy should be driven by data semantics rather than technical specifications, incorporating existing classifications about data ownership, sensitivity, and approved uses.
Organizations should generate least-privilege policies automatically by first inventorying all agents, their owners, and accessible data resources. This enables creating mission-specific policies rather than agent-specific ones, with enforcement through row filters, column masks, and tool parameter limits.
Centralized Control
A single decision authority must enforce consistent policies across all entry points, including API gateways, AI platforms, and data systems.
Equally critical is implementing functional kill switches that actually terminate agent capabilities, not just sessions. Effective revocation immediately blocks requests across all connected systems without requiring policy redeployment, with tiered responses ranging from tool restrictions to complete shutdowns based on observed behavior against declared missions.
Getting Started
Organizations should begin with a single workflow involving regulated data, identifying participating agents and generating initial policies for monitor-only operation. Key metrics to measure include authorization decision latency, the percentage of agents operating under least-privilege policies, and the time required to revoke an agent's access across all systems.
Related
