BlueBear Insights · Agent Security · 4 min read

AI Agent Authorization: Identity, Delegation, and Least Privilege

By Phillip Joe — Founder, BlueBear.ai · AI engineer

BlueBear governance evidence ladder connecting identity policy execution and outcome records
Production agents need a control decision and an evidence record for every consequential action.

AI agent authorization is the action-time decision that a specific agent may use a specific capability on a specific resource, for a delegated purpose, inside a bounded context. Authentication answers who the actor is. Authorization answers whether this action is permitted now.

The authorization tuple

allow = policy(subject, delegator, agent, action, resource,
               tenant, workspace, purpose, risk, time, approval)

Leaving any of these fields implicit creates confused-deputy and privilege-expansion risk. A model-generated plan must not be able to change the subject, scope, or approval requirement.

Decision sequence

  1. Authenticate the human or service that initiated the work.
  2. Resolve the versioned agent and its workload identity.
  3. Verify delegation: who allowed this agent to act, for what purpose, and until when?
  4. Resolve tenant, workspace, resource, data class, and requested tool action.
  5. Evaluate least-privilege policy and any separation-of-duties rule.
  6. Require a bound approval for high-impact actions.
  7. Issue or resolve a short-lived, audience-bound credential only after allow.
  8. Record the decision and downstream receipt under one correlation ID.

MCP authorization boundary

The Model Context Protocol authorization specification requires protected servers to validate that tokens were issued for that server and forbids forwarding the inbound client token to an upstream API. Use a separate upstream credential and keep bearer material out of prompts, traces, and model-visible context.

Policy example

{
  "subject": "agent:invoice-review:v7",
  "delegated_by": "user:finance-manager",
  "workspace": "finance-prod",
  "action": "invoice.propose_update",
  "resource_scope": "region:us;amount<10000",
  "approval_required": "invoice.execute_update",
  "expires_in": "15m"
}

Tests that prove the boundary

  • Replay the token against another server and expect denial.
  • Request a broader resource after approval and require re-approval.
  • Revoke the workload identity during a queued run and fail closed.
  • Inspect model context and telemetry for credential leakage.
  • Verify an administrator cannot both change policy and approve their own high-impact action without an explicit exception.

Review how BlueBear separates agent identity, workspace assignment, policy, and tool execution.

Primary sources