Requirements
- The system checks every action as the action is about to happen. A single check when the agent starts does not satisfy this requirement.
- The check names who is acting, not which credential was presented.
- The check names the particular thing being acted on and the arguments the action carries, not the service that holds it.
- Every call that changes anything passes through one shared checkpoint. A check that applies only when the caller passes in its permissions does not satisfy this requirement. Any code path that omits them is then allowed.
- If the check fails, or cannot reach an answer, the answer is no.
- A human approval authorizes exactly what the person was shown, and it cannot be reused for a different action.
- Revoked access is refused on the next call. The agent keeps running, and its other work continues.
Security considerations
Assume the content the agent reads carries attacker instructions. The attacker can then choose which action the agent requests. The attacker cannot change the answer, because the agent does not produce the answer. The decision may be computed anywhere, including inside the agent's own process, as long as the agent cannot reach the data the decision is read from.
Residual risk: An attacker who can write to that data, or to the relationships it records, controls the answer directly.
Non-qualifying systems
Commonly substituted components: a role assigned to the agent, or a list of the tools it may use. Any of the following disqualifies a system:
- The check happens when the agent starts, or when a tool is granted. It does not happen when the action is taken.
- The check names the service or the tool. It does not name the particular record being touched.
- An approval covers later actions of the same kind, rather than only the action the person was shown.
- Revoking access means restarting the agent.