May 2026 Summaries

As organizations increasingly integrate AI agents and agentic stacks into their operations, there's a pressing need to adapt existing policy frameworks like the Open Policy Agent (OPA) to meet the demands of these dynamic environments. Traditional OPA policies, designed for deterministic microservices, often fall short when applied to the delegated, multi-hop workflows of AI agents, leading to challenges such as over-broad access and weak delegation traces. The solution involves evolving the use of OPA by incorporating richer input contexts and real-time policy data synchronization with tools like OPAL, ensuring authorization reflects real-time changes and maintains strict delegation boundaries. This approach emphasizes the importance of ephemeral agent identities and the principle of Zero Standing Permissions, where agents operate under short-lived, delegation-scoped contexts to maintain security integrity. The integration of Permit.io can further simplify the management of distributed enforcement infrastructures, allowing organizations to maintain robust security practices without compromising operational efficiency.

The NSA's advisory "Careful Adoption of Agentic AI Services," published in collaboration with intelligence agencies from the UK, Australia, Canada, and New Zealand, addresses the challenges posed by autonomous AI agents in organizational settings. It highlights the systematic errors in deploying AI agents with human-based authorization models, leading to accountability issues as agents operate autonomously. The advisory outlines four key requirements: treating each agent as a distinct principal with cryptographic identity, using ephemeral and task-scoped credentials, ensuring authorization per action rather than at deployment, and integrating human approval for high-impact actions. The document emphasizes the complexity of implementing continuous authorization due to the dynamic nature of agent behavior and underscores the importance of maintaining accountability through comprehensive logging and policy enforcement. It also refers to ongoing work by NIST to develop standards for agent identity and authorization, indicating the necessity of both operational guidance and technical infrastructure to manage AI agent security effectively.

Zero Standing Privileges (ZSP) is an access model that shifts from granting enduring permissions to treating access as a transient, task-specific requirement, thereby minimizing security risks associated with idle privileges. Unlike the least privilege model, which focuses on minimizing the scope of access, ZSP limits the duration, ensuring permissions are granted only when necessary, for specific tasks, and are revoked automatically once the task is complete. This approach is particularly crucial for AI agents due to their ability to operate across various tools and workflows, which can lead to persistent authority without ongoing tasks. The ZSP model requires access decisions to be dynamic, based on real-time inputs such as the requesting identity, task context, intended action, and time constraints, ensuring a secure, task-bound access framework. It emphasizes that identity should be seen as a dynamic relationship governed by policy rather than a static trait, supporting stronger compliance and operational security.

This comprehensive guide discusses the implementation of OAuth in the Model Context Protocol (MCP) architecture, focusing on the challenges and best practices for securing AI-driven environments. It emphasizes the importance of properly implementing OAuth 2.1 to ensure secure client-server interactions, highlighting how OAuth serves as a foundational authentication protocol while stressing the need for fine-grained authorization at the tool-call layer. The text explains the importance of dynamic client registration, resource-specific token usage, and metadata discovery in preventing security pitfalls such as token reuse, scope inflation, and token passthrough. It also elaborates on the roles of protected resource metadata and authorization server metadata, the significance of maintaining distinct identities for humans and agents, and how dynamic client registration can enhance security. Additionally, it discusses the use of Permit MCP Gateway as an enforcement layer to manage OAuth flows, enforce granular policies, and ensure token containment, thereby augmenting OAuth's capabilities in managing AI agent permissions within MCP frameworks.

AI identity governance is a comprehensive framework designed to manage and control the actions of AI agents, focusing on who they act for, what they can do, and under what circumstances these actions are authorized and recorded. It emphasizes the importance of distinguishing between agent identity security, which concerns authentication, and AI identity governance, which is centered on authorization and accountability. The framework introduces the concept of agentic identity, which combines the delegating human, workflow context, and declared intent to ensure actions are appropriately authorized. Key governance controls include explicit agentic identity, deny-by-default policies, layered authorization, policy-as-code, and zero standing credentials to prevent unauthorized access. Guardian Agents play a role in observing agent behavior to detect policy gaps and suggest improvements. Effective governance requires a real-time synchronization of policy data and the maintenance of a comprehensive audit trail that reconstructs the authority behind each action. The "model proposes; policy decides" approach separates probabilistic model reasoning from deterministic policy enforcement, ensuring that AI actions are rigorously scrutinized and authorized by established policies rather than relying solely on the AI model's judgment.

The text discusses the security challenges and considerations surrounding the use of coding agents, which are AI tools capable of performing actions within development environments, such as running commands, editing files, and interacting with CI/CD systems. Unlike regular chatbots, coding agents have significant power over software systems, necessitating a robust security model to manage their permissions and actions. The primary risks include indirect prompt injection, excessive permissions, secret leakage, supply chain manipulation, and unclear delegation between agents. The article emphasizes the importance of tool-level authorization, where each action by an agent is evaluated in context, considering the user, task, environment, and required permissions, to ensure least privilege access. Permit.io is introduced as a solution to enforce fine-grained authorization policies without requiring custom middleware, allowing teams to control agent actions at a granular level, thereby protecting sensitive systems and data. The text advocates for a security approach that treats coding agents as delegated actors with constrained authority, ensuring that every action is authorized and audited, moving beyond superficial security measures to a comprehensive policy-driven model.

Agent identity security is a critical discipline focusing on the authentication and authorization of AI systems, ensuring that actions performed by agents align with their intended purpose and are authorized within the correct workflow context. This requires a clear distinction between workload identity, which authenticates a software's runtime using cryptographic credentials like SPIFFE/SVID, and agentic identity, which includes details about the delegating human, task scope, session, and declared intent. Effective security practices involve using standards like OAuth to issue narrow, short-lived, and resource-specific tokens, preventing broad access and potential misuse by unauthorized entities. Prompt injection is highlighted as an authority confusion problem, where untrusted text can lead an agent to perform unintended actions if data and authority are not properly separated. Multi-agent systems need careful management to prevent cascading trust attacks, requiring explicit delegation chains and reduced authority at each step. The operational security model should include detailed audit logs that reconstruct authority paths, and authorization must be enforced at runtime, considering dynamic factors like task, tenant, and resource context, rather than relying solely on static RBAC models.

The text discusses the concept of least privilege in AI agents and the importance of agentic identity, highlighting the challenges in managing access control due to the dynamic nature of AI agents that make decisions at runtime. Traditional service accounts are criticized for being overly broad and risky, as they often fail to capture the nuances of delegated tasks, leading to over-permission and security vulnerabilities. Instead, the text advocates for a robust access control system where AI agents carry an "identity envelope" that encapsulates the delegating human, workflow context, and declared intent, which is then used to request actions through a policy-enforcing gateway. This approach, termed "zero standing privileges," ensures that agents do not have direct access to sensitive credentials, thereby reducing the risk of unauthorized actions even if an agent runtime is compromised. The text emphasizes the necessity of continuous permission evaluation and downscoping in multi-agent systems, where each agent in the chain receives only the specific permissions required for its task, supported by an enforcement gateway that mediates tool calls and maintains the security of real credentials.

AI agent authorization requires a nuanced approach beyond traditional role-based access control (RBAC), incorporating relationship-based access control (ReBAC) for precision and adaptability in dynamic environments. While RBAC provides foundational guardrails by defining broad action categories agents can perform, it falls short in scenarios where real-time, context-specific decisions are crucial. ReBAC addresses these gaps by leveraging relationship modeling to determine if an agent can execute a specific action on a particular resource for a designated tenant. This approach is vital for ensuring secure operations as AI agents often operate under delegated authorities, interacting with multiple tools and resources within defined scopes. The combination of RBAC and ReBAC, supplemented by attribute-based access control (ABAC) or policy-based access control (PBAC) conditions, forms a comprehensive authorization framework, ensuring granular control and minimizing risks of over-permissioning. The implementation of such a system is critical for managing AI agents in production, where policy enforcement must be centralized and adaptable to evolving authorization demands.