Purpose
Enforce fine-grained authorization over models, prompts, corpora, tools, and actions so authenticated actors only receive the capabilities they are entitled to.
Engineering philosophy
Authentication without authorization is incomplete. Authorization decisions must be made outside the model and must apply to retrieved data and tool effects, not only to the HTTP route.
Why it matters
Confused-deputy and over-permissioned agents are primary causes of data breaches in AI systems. A model that can see everything can leak everything.
Common failures
- Authorization checked at UI only; API and agent paths bypass it
- Retrieval without document-level ACLs
- Tools inheriting broad service roles
- Tenant isolation bugs in multi-tenant AI products
Mandatory checks
Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.
Authorization shall be enforced server-side for AI features, tools, and retrieval
- Artifact
- Authz middleware/policy tests for AI feature, tool, and retrieval entry points
- Pass condition
- Automated tests cover 100% of production AI feature, tool, and retrieval entry points; unauthenticated or unauthorized callers are denied at 100% in the suite
Multi-tenant isolation shall be tested for AI data and memory paths
- Artifact
- Cross-tenant attack test suite results for AI data stores and memory APIs
- Pass condition
- 0 successful unauthorized cross-tenant reads/writes across ≥10 automated attack cases on AI data and memory paths
Least-privilege roles shall be defined for agents and automation identities
- Artifact
- Role matrix for every production agent/automation identity + IAM/policy export
- Pass condition
- 100% of production agent/automation identities appear in the role matrix with non-admin default roles; quarterly (or ≤90-day) access review recorded with 0 unexplained privilege escalations
Attribute-based controls shall govern access to sensitive document classes
- Artifact
- ABAC/policy config + sample allow/deny decisions for sensitive classes
- Pass condition
- PASS if sensitive document classes are enumerated and policy denies unauthorized class access in tests; inventory matches production classes
Recommended checks
Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.
Policy-as-code for tool and model access
- Artifact
- Policy-as-code repo/config for tool and model access (OPA/Cedar/IAM-as-code or equivalent) + latest CI policy-check report
- Pass condition
- Tool and model access rules are expressed as code and enforced in CI or admission; last failing-to-passing policy change ≤90 days shows a deny for unauthorized tool/model
Continuous access reviews for high-privilege agents
- Artifact
- High-privilege agent inventory + last access-review spreadsheet/report with decisions (keep/revoke/modify)
- Pass condition
- Every high-privilege agent identity was reviewed ≤90 days ago; ≥1 revoke or scope-reduction appears in the last two cycles (or attestation that none were warranted with reviewer sign-off)
Evidence required
- Authorization model documentation
- Tenant isolation test results
- Role matrices for agents and tools
Severity & risk
- Severity
- critical
- Impact if violated
- Risk level
- critical
- Typical residual risk (impact × likelihood)
Engineering best practices
- Propagate user context into tool calls; avoid confused deputy
- Deny by default for new tools and corpora
- Re-check authorization at each hop in multi-agent workflows
- Separate read and write capabilities aggressively
Automatic validations
- Automated cross-tenant access attempt tests
- CI policy checks for IAM/tool scopes
- Runtime denials logged and alertable
Manual validations
- Security review of new high-impact tools
- Periodic privilege creep audits
Examples
- A sales agent can query CRM records for the caller's accounts only
- An internal coding agent cannot access production secrets vaults
References
Crosswalks
Secure & Resilient Secure and Resilient
NIST AI Risk Management Framework · aligns-with
LLM06 Excessive Agency
OWASP Top 10 for Large Language Model Applications · supports
CC6 Logical and Physical Access
SOC 2 Trust Services Criteria · evidence-for
Security Security
AWS Well-Architected Framework · aligns-with
Future evolution
Portable authorization tokens that travel with agent tasks across organizational boundaries.