AgentKey · Security
AI agent authorization is the decision process that determines, at runtime, whether an AI agent is permitted to take a specific action against a specific resource, before the action reaches the external tool or API.
By AgentKey · Last updated 2026-10-08
A tool-level permission answers only whether an agent may call a tool at all. Argument-level authorization answers whether the agent may call it with a specific set of arguments: a support agent may refund up to 100, but not 10,000; an agent may send email, but only to allowlisted recipients. The same tool name can be safe in one call and destructive in another based purely on the arguments.
Common agent gateways and many permission systems gate at tool or scope level: whether the agent may invoke a capability, not with which parameters. Argument-level enforcement is where the field is converging, and a few newer projects evaluate arguments, but most shipping agent frameworks still gate at the tool and leave parameter checking to the policy layer. Because the danger of an action usually lives in its arguments, a tool-level allow rule leaves the dangerous calls open. Argument-level rules evaluate the action and its parameters at the moment of the call and deny by default when no rule matches.
Where the decision runs matters. A gateway or stdio proxy only sees traffic while it is in the request path, so a client that bypasses it produces no decision. An interceptor embedded in the client SDK runs before every tool call the client makes, so enforcement holds even when the call path changes. Coarse gates fail where argument checks hold: a regular-expression gate on tool calls blocked only 18 of 44 harmful calls (41%) and trivial rewrites evaded it, while a parameter-aware allow/deny policy closed the rest (Tracekit, arXiv 2609.35659).
For every tool call, authorization answers one question: may this agent perform this action on this resource with these arguments right now? The answer is a decision the agent must respect before the call is made.
An agent's behavior is not fully known when you deploy it. The model chooses actions from context. Static allow-lists of tools are not enough, because the same tool can be used correctly or dangerously depending on arguments. Authorization therefore evaluates the resource, the action, and the parameters at the moment of the call.
AgentKey's authorize function is this decision point. It evaluates the policy, conditions, and risk signals, returns an allow/deny/ask decision, and writes an evidence event whether or not the action proceeds.
AgentKey evaluates the arguments the agent presents at call time. If an adapter changes the arguments after the authorization decision (for example normalizing an amount downward), the changed call must be re-authorized to stay correct.
Authorization binds the proposed arguments to the decision, but it cannot detect an action whose danger is invisible in the arguments, such as a tool with hidden side effects that reference data an agent knows from context.
The runtime decision of whether an agent may take a specific action on a specific resource before the action runs. The outcome is allow, deny, or require human approval.
By authorizing each action at runtime against a policy that names the resource and action, with optional parameter conditions. No matching policy means deny by default.