Authorization Cannot Stop at the Start of an Agent Task
A permission granted at the start of an agent task can become wrong before the task is finished.
An agent may begin with approval to investigate a production issue. During execution, it finds a new document, calls another tool, or changes its plan. Each discovery can expand what the agent is able to do.
That means the original authorization is no longer enough.
Consider an agent helping prepare a production configuration change. It may be allowed to read the relevant logs, compare configuration files, and draft a proposed change.
It should not automatically gain permission to deploy that change.
The deployment step has a different risk profile. It affects a different resource, uses a different tool, and may require a different level of human accountability. Treating it as part of the original approval creates a gap between what the user authorized and what the agent eventually does.
A runtime authorization decision should evaluate:
- The agent identity
- The requesting user
- The tool being called
- The resource being accessed
- The current context
- The action the agent is attempting
The result can be allowed, denied, or held for approval.
The important part is timing. The check needs to happen at each meaningful transition, not just when the task starts.
The plan change is the control point
Agents don't always follow their initial plan. A new file can reveal a dependency. A tool can return data that suggests a more effective action. A user can ask the agent to continue after the original scope has changed.
That plan change should trigger a new authorization decision.
For the production example, the flow might look like this:
- The agent reads approved operational data.
- The agent drafts a configuration change.
- The agent requests deployment access.
- Policy evaluates the new action.
- The action is blocked or sent for human approval.
The agent can still be useful without receiving unrestricted authority. It can do the analysis and prepare the work while the higher-risk action remains bounded.
A practical buyer test
Ask to see what happens when an agent moves from reading to changing.
Then ask:
- Does the policy evaluate the action at runtime?
- Can it distinguish drafting from executing?
- What happens when the agent's plan changes?
- Is approval tied to the specific action and resource?
- Is the reason for the decision recorded?
If the answer is only “the user approved the task,” the control is probably too broad.
For AI agents, authorization isn't a checkbox at the start of execution. It's a continuing decision about whether the next action is justified in its current context.
