CONCEPT Cited by 1 source

Intent-based authorization

Intent-based authorization is the principle that an agent's effective permissions should be narrowed per-session to match the declared purpose of the current task, even when identity-based controls (RBAC, ABAC) would allow a broader action set.

Traditional authorization answers who may access a resource. Intent-based authorization adds the question why is this action being taken now? — and denies actions that fall outside the declared purpose, regardless of identity permissions.

Motivation

The gap arises because identity-based authorization was designed for humans clicking buttons. A human rarely tries actions outside their current task. But an AI agent runs on valid credentials and processes untrusted data (documents, tickets, table rows). An attacker who plants instructions in that data (indirect prompt injection) can steer the agent toward actions it's permitted to take but was never asked to perform — the confused deputy problem.

How it works

1. A declared intent is bound to the session — either pinned at design time (autonomous agents) or declared by a human at session start (interactive agents).
2. Every tool call is evaluated against the intent before execution.
3. The evaluation produces one of: ALLOW (within purpose), ASK (sensitive — needs human confirmation), or DENY (outside purpose).
4. Identity checks still apply — you must satisfy both identity AND intent.

Relationship to least privilege

Least privilege constrains what an identity can do. Intent-based authorization constrains what it may do for this task. They are complementary — least privilege narrows the ceiling; intent narrows the effective floor per session.

Relationship to tool scoping

Static tool scoping removes tools entirely from an agent's action set. Intent-based authorization keeps tools available (they're needed for other tasks) but gates their use per-session. This is necessary when the same agent handles multiple job types with different tool needs.

Seen in

• sources/2026-07-23-databricks-intent-based-authorization-omnigent — Databricks introduces intent-based authorization in Omnigent, demonstrating how it blocks an indirect prompt injection that exploits identity-based authorization's purpose-blindness.

Related

• concepts/prompt-injection — the attack class motivating intent auth
• concepts/confused-deputy-problem — the authorization gap it closes
• concepts/least-privileged-access — identity-layer least privilege
• patterns/intent-based-authorization — the implementation pattern
• patterns/deny-wins-policy-composition — how intents compose with other policies
• systems/omnigent — reference implementation