Security models for AI agents acting on humans need better authorization
Authorization Architectures for Tool-Using AI Agents
Cryptography and Security
Summary
AI agents can now use tools like databases or browsers on their own, but deciding when they are allowed to act for a human is not very well understood. The authors review many studies to identify gaps in how AI actions can be safely authorized, tracked, and controlled so humans remain in charge. They propose a new structured way to think about who can do what at different levels, and outline the steps needed to securely give AI agents permission to act. They also find that currently no system fully solves the problem, especially around real-time enforcement and auditing.
What this means in practice
- •For cloud security teams: Design authorization layers for AI services that invoke external APIs securely on behalf of users.
- •For enterprise software architects: Implement multi-stage permission checks ensuring AI tools only act within delegated human authority.
A survey. It maps existing work.
Authors
Rakesh Kumar Surapani, Pradeep Kumar Dolabehera Kakitapelli, Arun Morampudi, Praveena Padi
Abstract
Tool-using artificial intelligence (AI) agents, systems that autonomously invoke application programming interfaces (APIs), databases, browsers, and inter-agent protocols such as the Model Context Protocol (MCP), are becoming production infrastructure. Yet the security model governing when an agent is authorized to act on a human's behalf remains underdeveloped. Trustworthy human-AI systems require that every consequential agent action be traceable to a human principal, bounded by what that human actually delegated, and contestable after the fact; few documented deployments satisfy all three properties reliably and end to end. Existing literature addresses fragments of this problem in isolation, credential management for non-human identities, classical access control models, prompt injection, and audit trails, while giving little attention to the authorization decision point itself, the moment a tool invocation occurs, and mechanisms that make that decision correct, enforceable, and accountable. This review introduces a principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint as an organizing framework, and examines five interdependent layers: agent identity and credential lifecycle; delegation and scope propagation across multi-hop chains; runtime enforcement and just-in-time authorization at policy enforcement points (PEPs); prompt injection as an authorization bypass that breaks the principal hierarchy; and auditability, provenance, and non-repudiation. Drawing on a structured narrative review of 89 primary sources screened from approximately 180 candidates published between 2023 and 2026, we propose seven structural requirements, derive a four-layer reference architecture, apply the requirements to three deployable reference configurations, and identify runtime enforcement and aggregation bounds as the principal unresolved gaps.