AI Agents Need Authorization Decisions, Not Guardrails

In most enterprise AI deployments, nothing authorizes an agent's action. The controls that reached production are input filters, output classifiers, and system prompts that instruct a model to avoid certain behavior. Each of those is a steering mechanism. It changes the probability that the model does something unwanted, and it never produces a decision about whether a specific action on a specific object was permitted.

The distinction becomes concrete the moment someone asks a question with a real answer. Which policy authorized this agent to read this record. Which attributes were asserted at the time. Who signed the outcome. A filter cannot answer any of those, because a filter is not an authorization mechanism. A policy decision point is.

The category error in AI guardrails

Guardrails inherit their design from content moderation, where the objective is to shape the distribution of model output and the failure mode is a bad sentence. Probabilistic controls are appropriate to that problem.

Authorization inherits its design from access control, where the objective is a binary determination against policy, evaluated at request time and recorded as evidence. The failure mode is unauthorized release of a record. Probabilistic controls are not appropriate to that problem.

Applying the first discipline to the second produces a system that behaves well in testing and produces nothing an auditor can use. It also fails asymmetrically in a way that small pilots conceal. A filter that is 99 percent effective across a million tool calls per day permits ten thousand unauthorized actions, and the operator cannot enumerate which ones. The identity pillar settled this argument two decades ago. Usually correct is not an access control posture.

OWASP published the Agentic AI Top 10 in 2026 naming memory poisoning and identity abuse among the leading risks to agent systems. Both are data-layer problems. Neither is addressed by asking a model to behave.

An action request is an access request

Lattix treats an AI action request the way it treats any other request to act on data. The request reaches the policy decision point, and the decision point evaluates attribute-based access control rather than consulting a static grant.

The attribute categories that determine the answer are the ones that have always determined it: the subject, the device and its attestation state, the environment and geography the request originated from, the purpose of use asserted for the request, network posture, current risk signal, and the attributes of the data object itself. Purpose is the category most programs have never implemented as an evaluated attribute, and it is the first one AI workloads break, because a single corpus is read for support triage, model fine-tuning, and analytics under three different legal bases.

The result is a signed, short-lived decision. It carries the allow or deny, the reasons behind it, the hash of the policy version that produced it, and the content identifier it applies to. The policy enforcement point consumes that decision and enforces at decrypt time, which means the enforcement holds regardless of which orchestrator, retrieval index, message bus, or downstream agent the request traveled through. None of those intermediaries has to be trustworthy for the policy to hold, because the policy travels with the object rather than living in the service that happens to be serving it.

Defaults are fail-closed. An unreachable attribute adapter, an expired decision, a policy that cannot be located, or a tenant mismatch produces a deny rather than an optimistic allow. A control that permits an action when its inputs are missing is not a control. Revocation propagates to deny in under five seconds at the ninety-fifth percentile, which is the property that matters when the credential is sound and the agent behind it has been subverted.

Why the model cannot be the control

Model behavior is probabilistic by construction. Alignment work shifts the distribution and does not produce a decidable answer to a policy question. An architecture that asks a model to enforce its own constraints inherits the model's uncertainty into its control plane, and the control plane is precisely where uncertainty is unacceptable.

The workable separation is narrow and familiar. The model proposes. A deterministic control decides. The proposal can be adaptive, creative, and non-repeatable. The decision has to be repeatable, explainable, and signed, because the decision is the artifact that survives an audit.

That separation is also what makes AI systems governable at enterprise scale rather than pilot scale. A program that produces a decision record per action answers breach-scope questions in hours. A program holding transcripts answers them in weeks, if at all. This is the same architectural boundary that network zero trust reaches and stops at, arriving now on a faster timeline.

The second-order problem

When an agent reads across a data store with no object-level boundary and writes what it found into a memory store, a vector index, or a fine-tuned model, the access control gap does not stay in the moment it occurred. The derived artifact becomes a persistence mechanism for it.

Retrieval augmented generation is the clearest instance. A pipeline collapses many source systems into one index, and the index rarely carries the access control of the systems it was built from. The query is lawful, the retrieval is correct, and the content returned is content the requester could not have opened at the source. Nothing in the chain malfunctioned. The controls were never at the layer where the collapse happened.

Filtering at retrieval time does not close it, because the boundary has already been crossed and the system is reconstructing a permission decision from an embedding. The same pattern appeared earlier in agent credential delegation chains, where a token that was valid at issue time outlived the conditions that justified it.

What the standards are converging on

NIST published the SP 800-53 Control Overlays for Securing AI Systems concept paper in August 2025 and released an annotated outline for the predictive AI overlay in January 2026, with stakeholder feedback closing February 13, 2026. Five overlays are scoped, and two of them address AI agent systems, single-agent and multi-agent, as distinct control problems. Scoping them separately acknowledges that every agent-to-agent handoff is an authorization boundary that orchestration frameworks currently treat as an internal function call.

The NSA Zero Trust Implementation Guideline series, which began publishing in January 2026 with a Primer and a Discovery Phase, is built on attribute availability. Access decisions require asserted facts about subject, device, and context, and the published phases assume something evaluates those facts at request time. That assumption is what target-level sequencing rests on.

Neither body of work treats prompt engineering as a control. Both treat authorization as a system function with recorded output.

The near-term implication

The AI governance conversation in most enterprises is still about model selection and acceptable use policy. The audit conversation is already about evidence. Those two conversations meet at the point where an action request is evaluated, and organizations that place a policy decision point there now will have answers when the second conversation reaches them.

Logs are not proof. A decision record is.