An AI agent can follow an instruction and still be unauthorized to perform the action. That distinction matters once an agent can call tools, modify data, or trigger an external side effect.
A valid API key proves identity. It does not prove that this specific action is allowed.
A safer agent boundary asks for an explicit authorization decision before sensitive tool calls:
- What action is being requested?
- Which resource and scope does it affect?
- Which policy or capability grants permission?
- What should happen when the decision is missing or ambiguous?
The default should be fail-closed for high-impact actions. The agent can explain what it needs and ask for a narrower capability instead of silently guessing.
This is the design space behind PROF and Tokenis: make authorization and accountability visible at the tool boundary, while keeping the final policy decision explicit.
- PROF: https://github.com/tokenismcp/prof
- Tokenis MCP: https://github.com/tokenismcp/tokenis-mcp
The practical test is simple: if an agent cannot prove why it is allowed to act, should it be allowed to act at all?
Top comments (0)