Agent authorization

Agent authorization is the check that decides whether an AI agent may take a specific action, with specific arguments, on behalf of a specific principal, at the moment the agent proposes it. It covers the tools the agent can call, the records it can read or change, the amounts and limits that apply, and the actions that need a person's approval first.

Agents need this check for each action because they choose their next step at run time. The full list of actions an agent will attempt is unknown when it is deployed, so a role granted once at start-up cannot settle whether a given payment, record update or customer message is acceptable. The OWASP Top 10 for LLM Applications names this risk Excessive Agency (LLM06:2025) and traces it to three causes: excessive functionality, excessive permissions and excessive autonomy. Each one is an authorization question.

A workable design has three layers. Identity records which agent and version is acting, and for whom; the AI agent registry holds that record. Entitlement lists the tools, data and limits the agent holds under least privilege, written down in its agent mandate. The per-action decision evaluates each proposed action against the entitlement and the current context and returns one of four outcomes: allow, warn, require_approval or block.

Banks already recertify staff access at fixed intervals. The same review applies to agents: the owner confirms that each entitlement is still needed, and unused or excessive grants are removed. Revocation is part of authorization too. An agent kill switch withdraws every grant at once. In our own development environment, a policy whose rules did not match the shape of an agent's input applied its default decision and blocked the run, where its author had expected an approval request. Test each policy against real inputs before publishing it.

In KLA, tool permissions sit in the Tool Catalog, and the KLA Policy Engine evaluates proposed tool calls against the agent's published policy before they run. A require_approval outcome holds the action as a Decision Request in the Decision Desk until a reviewer decides.