Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI
2026-06-02 • Artificial Intelligence
Artificial IntelligenceCryptography and Security
AI summaryⓘ
The authors explain that as AI systems start acting and making decisions on their own, the old ways of controlling who can do what (authorization) don't work well anymore. They propose a new framework that lets AI agents pass on permissions, work together, and limit their access in smarter ways. Their approach treats permission sharing more like a contract with clear rules, not just simple tokens, and can be added on top of existing systems. They back up their ideas with formal proofs and tests to show it can help keep AI actions accountable and secure.
Agentic AIAuthorizationDelegationIdentity and Access Management (IAM)OAuth 2.0Recursive delegationResource scope attenuationAccess controlCompositional governance frameworkAccountability
Authors
Amjad Ibrahim, Yong Li
Abstract
As AI systems evolve from passive models into autonomous active agents capable of initiating actions, collaborating, and delegating tasks, the traditional boundaries of software systems blur. Traditional authorization and delegation frameworks, built around fixed principals, explicit requests, and static scopes, are insufficient to govern agentic systems. Agentic AI demands richer authorization semantics: agents must inherit and delegate permissions, act under time-limited authority, and coordinate through shared protocols. Existing Identity and Access Management (IAM) systems fail to fully capture this notion of agency, lacking mechanisms for recursive delegation, contextual boundaries, and dynamic scoping as executable governance primitives. Unlike access delegation standards such as OAuth 2.0, we treat delegation as a contractual term rather than merely a static token-based consent credential. This paper proposes a compositional governance framework that introduces primitives indispensable for agentic AI. We define types of delegation and their permissions and accountability implications, and we introduce a notion of resource scope attenuation to bound agentic access envelopes. These concepts are expressed as general relational definitions that can be composed into existing authorization domains (e.g., financial systems). To operationalize this composition, we define a compositional operator that overlays new agentic semantics, such as recursive delegation chains, onto existing relational policies without rewriting them. We substantiate this framework through formal proofs and empirical evaluation, showing that it provides a formal yet practical foundation for accountable authorization in agentic AI systems.