Designing Runtime Authorization for Long-Running AI Agents
We are getting good at handing AI agents work. We are slower at asking whether they should still have that access five minutes later.
That gap is turning into an identity problem. Old authorization assumes a fairly stable actor. A person signs in. A service gets a token. A role is checked. The request is allowed or it is not.
Agents do not sit still. They can run for a long time, call tools, hit APIs, pass work to sub-agents, change the plan, and keep going after the human who started the job has left the thread. If you only decide access at the start, the decision can go stale while the agent is still live.
Access for agents is not a one-time yes. It has to be a loop you keep running.
Where old IAM assumptions fall over
Most identity systems were built for people, apps, and fairly boring...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
