Skip to content

PATTERN Cited by 1 source

Observation-coupled authorization

Pattern

Authorize the initial resource read with least privilege, then record the resources the agent actually observes and use that record to authorize later sharing, rendering, collaboration, hand-off, and external egress.

1. Principal receives a narrow resource capability.
2. Policy boundary permits or rejects the resource operation.
3. If permitted, record the concrete observed resource on the work item.
4. Before any later sink action:
   - opening/sharing workspace or output
   - rendering a derived dashboard
   - inviting collaborator
   - handing work to another agent
   - writing to an external system
   - making an outbound request
   evaluate recipient/action policy against the observed-resource set.
5. Deny, require approval, redact, or permit according to policy.

Problem addressed

A tool-level allowlist answers “may this agent call queryWarehouse?” It does not answer “may this user view the dashboard that was built from the returned table?” Nor does it stop a previously allowed read from being copied into a less restricted system. Treating initial authorization as the only authorization point creates a privilege-escalation path through derived artifacts and collaboration.

Canonical Cloudflare instance

Cloudflare OS implements the pattern through service-specific Gatekeepers. It records every resource the agent observes, retains those observations with the agent and its work, and rechecks another user's access before they can open a workspace, interact with the agent, or view output. The same log informs policies for external writes, invitations, agent delegation, and outbound requests after sensitive reads. (Source: sources/2026-08-05-cloudflare-os-an-open-platform-for-agents-apps-and-work)

Relationship to adjacent patterns

  • Runtime information flow enforcement is the broader IFC shape: labels propagate through execution and compatibility is checked at transfers. Observation-coupled authorization is a practical form suited to agent workspaces where complete language-level taint propagation may be unavailable.
  • Credentialed proxy sandbox protects the action and credential boundary. Observation coupling decides whether a later action should be allowed based on what the agent has already seen.
  • Least privilege constrains initial access; observation coupling constrains downstream use of the results.

Trade-offs

  • Coverage versus usability: coarse provenance over-blocks sharing; fine provenance can be expensive and hard to correctly propagate through transformations.
  • State lifecycle: the system must define when an observation expires, is superseded, or is removed after data deletion/revocation.
  • Policy explainability: users need actionable explanations when a previously shareable artifact becomes restricted due to a newly observed resource.
  • Completeness: agent code can derive information without leaving a simple one-to-one resource trail. The source does not disclose Cloudflare OS's granularity or derivation model.

Seen in

Last updated · 622 distilled / 1,953 read