authorization

MGnarf is an open-source execution security gate preventing AI agents from self-approving protected actions, paired with MGnarfTest, an adversarial testing project; the author is recruiting developers and security researchers to independently challenge and break the system.

文章综合讨论了三个近期事件：CERT-In 报告 AI 代理越权访问生产系统、Check Point 披露 LiteLLM 网关漏洞、ServiceNow 发布运行时凭证校验产品 AI Passport，核心关注执行前如何真正强制代理权限边界。

提出一个针对文件发送型 AI agent 的合成验收测试：审批应绑定到具体收件人、内容修订与动作并带过期时间，字段任一变化都需重新授权，且应记录拒绝后的实际状态证据。

该论文提出'standing'概念，研究多用户聊天中智能体的承诺能否被非债权人取消，并在六个模型上区分未授权释放与覆盖两类错误，发现自维护承诺账本加释放策略可显著提升严格准确率。

作者指出生产环境中 AI 代理的防护系统常把业务策略拒绝、输出校验失败和授权服务不可用统一记录为 POLICY_BLOCK，导致策略审查和客户纠纷中误判真正被策略拒绝的案例。文章强调停止执行是合理的，但审计记录必须区分拒绝原因。

分析了人类对 AI 代理的审批为何可能实际授权了与人类所见不同的操作，并提出在执行时对关键字段重新计算摘要进行比对、以单次条件更新消费授权的解决方案。

The author argues that monitoring AI agent actions does not answer the authorization question, since the absence of an objection (no flag, timeout continuation, unresponsive reviewer) is not evidence that an action was permitted. They contend agents should act autonomously within defined authority, but systems must be able to establish why a given action was authorized beyond 'nobody stopped it'.

Gaowei Chang（ANP开源社区创始人）详细解读Meta新发布的PAP（Personal Agent Protocol）规范，说明其核心设计——读写分离的授权范围、跨API/MCP/聊天/Web的会话一致性，以及与MCP、A2A、ANP的差异。

RSA launched Agent ID and SailPoint expanded its Agentic Fabric within days of each other, both adding runtime authorization and guardrails for enterprise AI agents — highlighting that 79% of enterprises run agents in production while only ~2% have identity governance tools for them.

Meta released the PAP (Personal Agent Protocol) specification, and this post provides a deep-dive comparison with MCP, A2A and ANP, covering identity (CIMD + DPoP-bound tokens), OAuth 2.0 authorization, OpenAPI/MCP-based interaction, and /.well-known/poppy.json service discovery.

The author argues that merely proving a human clicked Approve in an AI system is not the same as proving the approval was legitimate — and that the real governance challenge is establishing why that human's decision was authoritative at a given time. It asks how builders of high-consequence agentic systems should think about eligibility, assignment, authority, independence, and timeliness.

Guillermo Rauch introduces gdp-ts, a TypeScript library, linter, and AI skill implementing 'Ghosts of Departed Proofs' so that authorization and entitlement proofs are enforced at compile time, making a whole class of security bugs hard to ship—especially when agents are generating most of the code.

Drawing on the SalesBleed incident, the author argues AI agents need task-scoped permissions (like a valet key) rather than broad role-based access, promoting Tenuo, an Apache 2.0 open-source project whose AAT Internet-Draft was cited by NIST on agentic AI identity and authorization.

A discussion on a common AI agent security problem: an agent can hold valid identity, permissions, and tool access while its action is still wrong — such as scope drift, data exfiltration, or sub-agents inheriting broader access than intended — asking how authorization should be re-checked around sensitive tool calls.

The author observes that the AI agent ecosystem is heavily prioritizing token cost optimization while neglecting security, and raises important questions about agent authorization, identity boundaries, and permission inheritance as agents become more autonomous and spawn sub-processes.

Praxa is an evidence-bound agent harness that explicitly separates proposal, authority, dispatch, verified external effect, and promotion states via deterministic admission and brokered execution. The study reports benchmark pilots and audits showing moderate token-efficiency gains but explicitly notes it does not establish adversarial security or production benefit.

The piece argues prompt injection has evolved from a content-filtering problem into a provenance/authorization problem in agent stacks: untrusted read output can silently drive privileged write-tool arguments (a confused deputy), and defenses must bind authorization to the user's original intent via trust labels, signed intent digests, read-only sub-agents, and scoped authority rather than per-tool allowlists.

The article discusses the complexities of authorization for AI agents, emphasizing that tool access alone is insufficient and runtime decisions based on context, policies, and budgets are essential for safe production deployments.

The article discusses challenges in handling authorization for AI agent tool calls in production, including issues like context drift and multi-turn inconsistencies, and requests community input on effective architectural patterns.

Discusses the liability issues surrounding AI agents in financial operations, highlighting the gap between logging actions and proving authorization, and the need for better solutions beyond log files.