Limit an agent to the user’s approved actions.
An agent host runs software that can call tools for a user. Its requests must remain within the user’s grant and the server’s access rules.
Why this lesson?
An agent may read a customer’s orders. If the model asks to cancel an order, the tool server must reject that action under a read-only grant.
Learning goal and prerequisites
Request a limited tool token
The user has already granted permission to read orders. The trusted backend agent service authenticates itself and exchanges the user’s subject token for a token intended for the tool server. This keeps the user’s delegated authority separate from the agent service’s own identity.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
An artificial intelligence agent may take several actions to finish one user request. That creates a new authorization problem: the agent may be technically capable of many actions even though the user approved only a small task. The system needs a way to keep the agent’s authority inside that task.
A safe design starts with the user’s verified identity and the requested goal. The system determines which tools, resources, and actions are necessary, then gives the agent or tool caller only that authority. The grant can also be limited by time, recipient, tenant, or delegation depth.
This is useful because model output is not permission. A model can misunderstand a request, make an error, or be influenced by untrusted content. When the tool server independently checks a narrow credential and the requested action, a bad model decision has less power to cause damage.
Sensitive actions may require an additional approval or step-up authentication before execution. Good agent authorization also keeps an audit trail showing who requested the task, what authority was delegated, which tool enforced the decision, and why the final action was allowed or denied.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.