APRF-11 · Authorization

Purpose

Enforce fine-grained authorization over models, prompts, corpora, tools, and actions so authenticated actors only receive the capabilities they are entitled to.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

AUTHZ-M1L3 · DefinedTier 2 · ProductionhybridE3
Privileged AI feature, tool, and retrieval entry points shall enforce authorization server-side—so authenticated callers lacking required permission or scope cannot invoke those surfaces.
Artifact
Inventory of privileged AI feature/tool/retrieval entry points + server-side authz policy + authz suite (authenticated-but-unauthorized denied)
Pass condition
100% of privileged AI feature, tool, and retrieval entry points enforce authorization server-side; 0 successful requests from authenticated callers lacking required permission or scope in the authz suite (measuredAt ≤90 days). If no privileged AI feature, tool, or retrieval entry points exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure every AI feature, tool call, and retrieval is authorized server-side and never by model output alone.
Threats mitigated
Privilege EscalationUnauthorized Tool UseData ExfiltrationPrompt InjectionExcessive Agency
Protects
ToolsDataAPIsExternal SystemsIdentity
MITRE: ATLAS AML.T0051 · ATLAS AML.T0053 · ATLAS AML.T0085 · ATLAS AML.T0085.000 · ATLAS AML.T0086 · ATT&CK T1078 · ATT&CK T1548
Server-side authorization makes an injected or hallucinated instruction insufficient on its own to reach data or tools. It is the control that most reliably converts a successful prompt injection into a denied request.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHZ-M2L3 · DefinedTier 2 · ProductionhybridE3
Multi-tenant AI data and memory paths shall deny unauthorized cross-tenant reads and writes—proven by an automated attack suite, not by tenant filters in code alone.
Artifact
Inventory of multi-tenant AI data/memory paths + cross-tenant attack suite (≥10 cases) + scored report
Pass condition
0 successful unauthorized cross-tenant reads/writes across ≥10 automated attack cases on AI data and memory paths (measuredAt ≤90 days). If no multi-tenant AI data or memory paths exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Prevent one tenant's data, memory, or retrieval context from reaching another tenant.
Threats mitigated
Unauthorized Memory AccessData ExfiltrationSensitive Information DisclosurePrivilege Escalation
Protects
DataMemoryContextUsers
MITRE: ATLAS AML.T0085 · ATLAS AML.T0085.000 · ATLAS AML.T0036 · ATLAS AML.T0057 · ATT&CK T1213 · ATT&CK T1530
Vector stores and agent memory are commonly shared substrates where tenant filters are applied late or inconsistently. Tested isolation prevents the cross-tenant retrieval and memory reads that would otherwise leak regulated data into another customer's context.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHZ-M3L3 · DefinedTier 2 · ProductionhybridE3
Production agent and automation identities shall appear in a role matrix with non-admin default roles—and a ≤90-day access review shall record 0 unexplained privilege escalations.
Artifact
Inventory of production agent/automation identities + role matrix/IAM export + ≤90-day access-review record
Pass condition
100% of production agent/automation identities appear in the role matrix with non-admin default roles; quarterly (or ≤90-day) access review recorded with 0 unexplained privilege escalations (measuredAt ≤90 days). If no production agent or automation identities exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Constrain what an agent identity is permitted to do so that a compromised agent has limited reach.
Threats mitigated
Privilege EscalationExcessive AgencyAgent HijackingData ExfiltrationTool Abuse
Protects
IdentityToolsDataExternal SystemsInfrastructure
MITRE: ATLAS AML.T0012 · ATLAS AML.T0053 · ATLAS AML.T0086 · ATT&CK T1078 · ATT&CK T1098
Agent identities accumulate broad permissions because scoping each tool is more work than granting a wide role. Least-privilege roles cap the blast radius when an agent is hijacked, so a successful injection yields limited rather than administrative reach.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHZ-M4L5 · OptimizingTier 3 · Mission CriticalhybridE3
Sensitive document classes used by AI retrieval or grounding shall be enumerated and governed by attribute-based policy (subject/resource attributes)—with tests proving unauthorized class access is denied and the inventory matching production classes.
Artifact
Sensitive document-class inventory + ABAC/policy config + deny-test results matching production
Pass condition
Sensitive document classes are enumerated; attribute-based policy (subject/resource attributes) denies unauthorized class access in tests; inventory matches production classes (measuredAt ≤90 days). If no sensitive document classes are in scope for AI retrieval or grounding, score NOT_APPLICABLE.
Why this control exists
Threat map
Enforce attribute-based restrictions so sensitive document classes cannot enter retrieval or context without authorization.
Threats mitigated
Data ExfiltrationSensitive Information DisclosureUnauthorized Memory AccessPrompt Injection
Protects
DataContextUsers
MITRE: ATLAS AML.T0085.000 · ATLAS AML.T0036 · ATLAS AML.T0064 · ATLAS AML.T0057 · ATT&CK T1213
Coarse index-level permissions let a single over-broad query surface regulated documents. Attribute-based controls evaluate classification and clearance per document, keeping restricted classes out of the retrieved context in the first place.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Authorization model documentation
Tenant isolation test results
Role matrices for agents and tools

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

AUTHZ-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Tool and model access rules shall be expressed as code (OPA, Cedar, IAM-as-code, or equivalent) and enforced in CI or admission—with a ≤90-day failing-to-passing policy change that shows a deny for an unauthorized tool or model.
Artifact
Policy-as-code for tool/model access + CI/admission policy-check + ≤90-day deny evidence
Pass condition
Tool and model access rules are expressed as code and enforced in CI or admission; last failing-to-passing policy change ≤90 days shows a deny for unauthorized tool/model (measuredAt ≤90 days). If no production tools or models subject to access control exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Express tool and model access rules as reviewable, testable code rather than ad hoc configuration.
Threats mitigated
Privilege EscalationUnauthorized Tool UseExcessive AgencyConfiguration Drift
Protects
ToolsModelsIdentityRuntime
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Codified policy makes authorization decisions consistent, diffable, and testable across environments, removing the silent drift that produces over-permissive tool access. Its contribution is assurance quality; the techniques it ultimately blocks are those already mapped under AUTHZ-M1.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHZ-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Every high-privilege agent identity shall be reviewed ≤90 days ago, with ≥1 revoke or scope-reduction in the last two cycles—or a signed attestation that none were warranted.
Artifact
High-privilege agent inventory + ≤90-day access-review report with keep/revoke/modify + revoke or none-warranted evidence
Pass condition
Every high-privilege agent identity was reviewed ≤90 days ago; ≥1 revoke or scope-reduction appears in the last two cycles (or attestation that none were warranted with reviewer sign-off) (measuredAt ≤90 days). If no high-privilege agent identities exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Detect and remove privilege that high-privilege agent identities accumulate over time.
Threats mitigated
Privilege EscalationExcessive AgencyInsider MisuseShadow Agents
Protects
IdentityToolsData
MITRE: ATLAS AML.T0012 · ATT&CK T1078 · ATT&CK T1098
Agent entitlements grow as new tools are added and are rarely revoked when those tools fall out of use. Periodic recertification removes dormant privilege that would otherwise be available to whoever compromises the agent identity.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

Authentication without authorization is incomplete. Authorization decisions must be made outside the model and must apply to retrieved data and tool effects, not only to the HTTP route.

Why it matters

Confused-deputy and over-permissioned agents are primary causes of data breaches in AI systems. A model that can see everything can leak everything.

Common failures

Authorization checked at UI only; API and agent paths bypass it
Retrieval without document-level ACLs
Tools inheriting broad service roles
Tenant isolation bugs in multi-tenant AI products

Severity & risk

Severity: critical; Impact if violated
Risk level: critical; Typical residual risk (impact × likelihood)

Engineering best practices

Propagate user context into tool calls; avoid confused deputy
Deny by default for new tools and corpora
Re-check authorization at each hop in multi-agent workflows
Separate read and write capabilities aggressively

Automatic validations

Automated cross-tenant access attempt tests
CI policy checks for IAM/tool scopes
Runtime denials logged and alertable

Manual validations

Security review of new high-impact tools
Periodic privilege creep audits

Examples

A sales agent can query CRM records for the caller's accounts only
An internal coding agent cannot access production secrets vaults

References

Crosswalks

Show 20 peer mappingsexpand

Secure & Resilient Secure and Resilient
NIST AI Risk Management Framework · aligns-with
LLM06 Excessive Agency
OWASP Top 10 for Large Language Model Applications · supports
C5.1 Authentication
OWASP AI Application Security Verification Standard (AISVS) · aligns-with
C5.2 AI Resource Authorization & Classification
OWASP AI Application Security Verification Standard (AISVS) · supports
C5.3 Multi-Tenant Isolation
OWASP AI Application Security Verification Standard (AISVS) · partial
C9.1 Execution Budgets, Loop Control, and Circuit Breakers
OWASP AI Application Security Verification Standard (AISVS) · supports
C9.2 High-Impact Action Approval and Irreversibility Controls
OWASP AI Application Security Verification Standard (AISVS) · supports
C9.3 Component Isolation and Tool Authorization
OWASP AI Application Security Verification Standard (AISVS) · supports
C9.5 Agent Authorization, Delegation, and Continuous Enforcement
OWASP AI Application Security Verification Standard (AISVS) · supports
C9.6 Shutdown and Graceful Degradation
OWASP AI Application Security Verification Standard (AISVS) · supports
C10.1 Component Integrity
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.2 Authentication & Authorization
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.3 Secure Transport
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.4 Schema, Message, and Input Validation
OWASP AI Application Security Verification Standard (AISVS) · partial
CWE-352 Cross-Site Request Forgery (CSRF)
OpenCRE (Open Common Requirements Enumeration) · partial
CWE-384 Session Fixation
OpenCRE (Open Common Requirements Enumeration) · partial
L7 Agent Ecosystem
CSA MAESTRO (Multi-Agentic Threat Model) · supports
trust-misuse Trust Misuse Between Legitimate Agents
CSA MAESTRO (Multi-Agentic Threat Model) · aligns-with
CC6 Logical and Physical Access
SOC 2 Trust Services Criteria · evidence-for
Security Security
AWS Well-Architected Framework · aligns-with

Future evolution

Portable authorization tokens that travel with agent tasks across organizational boundaries.