Agent Autonomy Isn't the Risk, Loss of User Authorization Is

The industry is slowly adopting a single-user agentic security model where we’re focused on identifying and defining entitlements for agents interacting with tools and resources. The reason this works for single user systems is that attribution may be inferred. Consequently, the entitlements of the agent that actually performs work at the end of a delegation chain, will match some combination of the entitlements of that originating user and the application controls they want to put on the system which we can generically refer to as intent. I describe this as the OpenClaw school of agentic security, since OpenClaw was many practitioners’ first real exposure to agentic.

Enterprise agent deployments aren’t single-purpose assistants sitting behind one person’s login. You may have a coding agent running on your desktop, but the supporting agentic infrastructure is multi-user. Instead of being able to infer the originating user, there’s no attribution. This is why the very people who live and breathe risk quantification, the insurance industry, are walking away from covering AI related incidents. New ISO exclusions strip AI-related losses out of standard liability coverage entirely, and the only way back in is affirmative coverage, underwritten by carriers now asking a question that exposes the flaw in treating agents as fully autonomous workers: when your agent took that action, whose authority was it acting under, and can you prove it?

Authorization Lineage Provides a Scalable Solution

Your organization already has an identity provider where you’re managing users and service accounts. If you were able to associate a request with an identity and reliably propagate that identity across delegation, you could use that identity to authorize every agent action. You no longer need to care what agent is performing an action because the action is attributed to and bound to policies defined for that identity. Intent still provides important guardrails, but this is context that can be assigned at the same time the identity is being associated to the request. Such a system no longer needs individual agent entitlements, and the only constraint on autonomy is ensuring delegation stays within the control plane responsible for propagating the identity information. This allows security and compliance teams an easy way to govern agentic environments without impacting the business objectives they were deployed to provide.

By ensuring authorization lineage from request to authorization, agent autonomy is no longer the problem, and this makes governing agentic systems a much easier problem to solve than trying to define entitlements for every current and future agent deployed in your environment.