Tag
authorization
27 entries, including 14 patterns.
- Pattern
Prompt-Independent Action Authorization
Treat a leaked prompt as reconnaissance, then prove the target service still rejects out-of-scope actions regardless of the words the model uses.
- Pattern
Retrieved Evidence Promotion Gate
Keep source claims and embedded instructions out of application authority, even when the poisoned chunk wins retrieval.
- Pattern
Effect-Bound Tool Route Gate
Authorize the effect at the service, regardless of which agent tool pipeline requested it.
- Pattern
Retrieved Context Action Boundary
Treat every retrieved chunk as evidence with provenance, while reserving tool and policy authority for a separate application-controlled gate.
The guardrail only wrapped one kind of tool
A per-tool safety check can be correct on the route it covers and irrelevant on the route that makes the same consequential change.
- Pattern
Resource-Bound Action Budget
Keep conversation policy for sequencing, but enforce cumulative limits in an atomic resource ledger across sessions and retries.
The budget reset with the conversation
Session-aware tool policy can remember a transfer, but a fresh conversation can forget it. Put durable limits at the resource that moves the money.
- Pattern
Evidence-Bound Callback Completion
Accept a completion as a scoped claim, then verify independent evidence and current authorization before the next side effect.
- Pattern
Task-Bound Artifact Fetch
Translate an external agent's file reference into a narrowly authorized fetch and a receipt for the bytes actually consumed.
The artifact pointed somewhere else
An agent's file result can make the receiving assistant fetch under its own network identity. Treat artifact references as requests for access, not as files already received.
The callback said done
A workflow completion token can close a task without proving that the approved work happened. Verify the result at the boundary before an agent acts on it.
- Pattern
Replay-Fenced Agent Side Effects
Give one approved intent one durable target-side identity, regardless of workflow retries, forks or restarts.
- Pattern
Revocable A2A Push Subscribers
Make a task's outbound update subscription expire with its subscriber's entitlement, including queued retries.
The checkpoint did not undo the transfer
Replaying an agent workflow can repeat a real-world action unless the target recognizes the same operation.
The webhook kept listening
An A2A task can keep sending updates to a once-authorized subscriber after that subscriber loses access.
- Pattern
Revocation-Aware Policy Gates
Make policy freshness an explicit precondition for privileged agent actions, and prove revocations take effect at every serving gate.
The revocation that never reached the gate
A centrally approved policy change does not revoke an agent's access until every consequential gate stops using the old revision.
- Pattern
Same-User Elicitation Binding
Require the browser principal completing an MCP URL elicitation to match the authenticated principal that initiated it.
The link connected the wrong account
MCP URL elicitation keeps credentials out of the agent, but a copied authorization link can still bind a victim's account to the attacker's session.
A task ID is not an authorization boundary
A2A task handles identify work. They do not decide who may read its artifacts, cancel it, or receive its updates.
- Pattern
Task-Bound A2A Authorization
Bind every task read, stream and mutation to the authenticated caller's ownership and action rights, not possession of its ID.
- Pattern
Approval Bound to Action
Preserve the exact action a person reviewed, then verify and consume its approval at the execution boundary.
Approval has to survive the handoff
A person approves one action. The dispatcher must prove it is still executing that action after a pause, retry or delegation.
- Pattern
Permission Freshness at Retrieval
Enforce caller access before model context assembly and place an explicit limit on stale permission state.
The index kept the permission
Removing access at the source does not immediately remove it from an AI index, a cached answer or an existing conversation.
Two allowed actions can still be the breach
Per-tool permission is not an architecture. The control is which combinations you will not allow in one session.
MCP access is now an IdP problem
The privilege decision leaves the consent screen and sits in identity policy. The blast radius sits there too.