Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsGive every AI agent a distinct, accountable identity, then authorize each task against the specific resource and operation it needs. Choose delegated user access, agent-owned access, or token exchange according to whose data is involved and whether a user is present. Enforce the decision at the API that performs the action—not just in the prompt or tool list—and make grants reviewable, traceable, and revocable.
Start by mapping the workflow, not choosing a role
An agent call is a proposed action, not proof that the action is allowed. Before assigning permissions, map the whole route from request to result: the user or system that starts the work, the agent, every tool or intermediate service, and the API or data store that ultimately acts.
As an Amazon Associate I earn from qualifying purchases.
For each task, record:
- The API, service, collection, or other resource the agent must reach, and who owns it.
- The required operation: for example, read a record, create a draft, send a message, export data, delete an item, or change access.
- The tenant, workspace, account, or other boundary that limits the target.
- Whether a user is present, whether that user’s individual permissions should govern access, and whether the task runs interactively or in the background.
- The sensitivity of the data and the consequence of an incorrect or unauthorized action.
This inventory should include every hop, including calls from one agent to another. Australian government cyber guidance describes agentic systems as combinations of models, tools, data, memory, and planning; securing only the model or front-end leaves the rest of that route unaccounted for.
Give the agent its own identity and an accountable owner
Create a stable, dedicated principal for each agent or tightly bounded agent workload. Record a human or team owner, the agent’s purpose, the systems it may use, and who can approve, review, and revoke its access. Keep this principal separate from the person who asks the agent to do something: the agent is the caller, while the user may be the source of the request and the authority whose data or permissions are relevant.
#1 Best Overall
That distinction should survive into audit records. Where a user initiates or delegates work, preserve both the agent identity and the user or delegation context so an investigator can tell which workload acted and on whose authority. Do not give the agent a person’s password, reusable session cookie, or unrestricted human session. AWS guidance calls for distinct service identities and signed user-context claims through the call chain; Microsoft documents agent identities and downstream token acquisition.
Keep the identity’s purpose and ownership current as the agent, its tools, or its business use changes. A shared identity for unrelated agents or teams makes it harder to assign responsibility and encourages grants that are broader than any one workflow needs.
Choose the authorization pattern for each resource and task
Base the choice on four questions: who owns the data, whether a user is present, whether the work is interactive or background, and whose permissions should determine access. The patterns below can coexist in a single application; choose separately for different resources or workflow steps.
Rank #2
- Used Book in Good Condition
| Pattern | When it fits | Authority represented | Design check |
|---|---|---|---|
| OAuth 2.0 authorization code with user delegation | Interactive work involving a particular user’s data or actions. | The user’s consent and delegated scopes. | Request only the scopes required for the task, and handle user or administrator consent deliberately. |
| OAuth 2.0 client credentials | Background automation or access to organization-owned resources when a user is not approving each run. | The agent’s own preconfigured permissions. | Constrain the agent’s grants to the intended resources and operations; there is no per-run user decision to narrow them. |
| On-behalf-of token exchange | A signed-in user invokes an agent that must call downstream services with per-user access rules. | The authenticated user together with the agent or workload identity. | Exchange for a token intended for the downstream audience, and have the target service evaluate the user context and its own policy. |
For example, a customer-service agent could use delegated access to retrieve the requesting customer’s records, client credentials to read an organization-wide knowledge collection, and token exchange to call a separate case system that applies the signed-in user’s permissions. The fact that one pattern is appropriate for one resource does not make it the right grant for every connection the agent has.
Turn each task into a narrow grant
Translate the inventory into specific permissions at the smallest practical boundary: operation, resource, data sensitivity, and tenant or workspace. “Read this knowledge collection” or “create a draft ticket in this workspace” is a better design target than a broad role such as “manage support data.” Where the platform supports it, separate read from write access and keep export, deletion, administration, and permission changes out of ordinary task grants.
Use a stronger gate for actions with larger consequences. Depending on the platform and workflow, that may mean human approval, a separate role, a short-lived elevation, or a distinct agent identity for remediation. AWS recommends permission boundaries, IAM conditions, short-lived credentials, and just-in-time elevation for higher privilege. Microsoft’s least-privilege guidance emphasizes explicit scopes, tool allowlists, and revocation workflows.
Do not silently broaden a role because a call returns access denied. First verify that the attempted operation and target belong to the approved task. If they do, amend the grant deliberately, document the reason and owner, and keep the new boundary as narrow as the platform allows. If they do not, the denial is the correct outcome.
Make consent and provisioning explicit
Consent, provisioning, and obtaining an access token are related but distinct steps. Use the identity platform’s supported flow, verify the exact permissions and token audience, and confirm which party—user, administrator, or workload owner—must approve the grant.
Microsoft’s documentation for delegated Microsoft 365 access describes users or administrators consenting to API permissions during an OAuth flow. Requested scopes such as User.Read and Mail.Read are recorded for the agent client, and approved delegated scopes can appear in the token’s scp claim; some permissions require administrator consent. In Microsoft’s documented interactive agent flow, the consent request records permission but does not itself return a token: token acquisition is a separate step. These are Microsoft platform details, not universal rules for every OAuth provider.
Where the identity platform supports them, application permissions and access packages can standardize agent access and provide expiry or revocation controls. Treat approval as a bounded grant with an owner and a lifecycle, not as blanket, permanent authorization for anything the agent may later be asked to do.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Enforce the decision at the API and constrain the tools
The prompt, agent framework, and gateway can help limit what an agent proposes, but they are not substitutes for authorization at the service that reads or changes the resource. Carry signed identity and delegation context through the call chain; each downstream API should validate the caller and decide whether that identity, user context, target resource, and operation are allowed. Recheck at each service boundary rather than assuming an earlier component’s approval covers every later call.
Expose only the approved tool actions the workflow needs. Treat tool parameters and destinations as security-sensitive: validate the exact resource and operation before execution, and do not let model-generated input redirect an otherwise authorized tool to an unintended target. In a multi-agent workflow, authenticate and authorize every agent-to-agent and agent-to-service hop; one agent’s permission should not automatically become another agent’s permission.
Best Value
Keep credentials out of prompts, model context, and logs the agent can access. Use the platform’s protected credential mechanisms and avoid exposing reusable secrets to agent code where possible. AWS warns that weak credential handling can expose user credentials or let an agent act beyond intended authorization; broad tools and chained agents can compound that exposure.
Log, review, expire, and revoke access
For each meaningful action, retain enough information to reconstruct who or what acted and what happened. A useful record includes:
- The agent principal and its owner.
- The initiating user or delegation context, when applicable.
- The tool and API, target resource, requested operation, authorization decision, and outcome.
- Relevant provenance about the data and inputs that informed the action, subject to the organization’s data-handling rules.
Review both grants and observed use for drift: an agent may gain new tools, change purpose, or stop using a permission that remains active. Set a review cadence proportionate to how quickly the deployment changes, and make it possible for the owner or an administrator to revoke access without rebuilding the entire application. Prefer short-lived credentials and bounded elevation for sensitive work where supported.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchNIST NCCoE’s February 2026 concept paper identifies delegation, logging and transparency, and data-flow provenance as relevant capabilities. It is a concept paper, not a finalized standard. AWS guidance also calls for continuous validation and review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
