Notifications
Clear all
Topic starter
30/07/2026 10:49 pm
TL;DR: SpiceDB models authorization as a typed relationship graph with consistency controls, caveats, and delegated permissions so applications can make the correct decision every time an actor accesses a resource, according to Authzed. The key issue is not connecting agents to identity, but enforcing authorization at the point of action with current state.
NHIMG editorial — based on content published by Authzed: SpiceDB and AI agent authorization
Questions worth separating out
Q: What should security teams do when AI agents need access to tools and data?
A: Security teams should treat AI agents as runtime access actors and separate them from static machine identities.
Q: Why do stale authorization decisions create risk in dynamic environments?
A: Because a correct policy can still produce the wrong outcome if the system evaluates it against old relationship data.
Q: What breaks when delegation is handled only with bearer tokens?
A: Bearer tokens copy authority without making the delegation chain visible or narrow enough for task-scoped control.
Practitioner guidance
- Map every delegated action to a relationship path Identify how users, service accounts, and AI agents gain access to tools, documents, and tasks, then express those paths as relationships instead of scattered application rules.
- Bind sensitive checks to fresh authorization state Require the application to use the latest relevant revision when revocation, reassignment, or task completion changes access during the same workflow.
- Use caveats for environment-bound agent actions Attach context conditions such as time, location, threshold, or task identifier to permissions that should only hold in a specific runtime situation.
What's in the full article
Authzed's full article covers the implementation detail this post intentionally leaves for the source:
- Schema patterns for objects, relations, permissions, and graph traversal in SpiceDB
- How CheckPermission, CheckBulkPermissions, and ZedTokens behave in real workflows
- Examples of caveats, expiration, and delegated access across agent and application paths
- Practical use of the Watch API for audit and derived authorization views
👉 Read Authzed's analysis of AI agent authorization with SpiceDB →
AI agent authorization in SpiceDB: are your controls keeping up?
Explore further
30/07/2026 10:56 pm
Continuous authorization is the real control boundary for agentic systems. Identity proof alone does not answer whether an action should proceed. When an agent can request tools, documents, or delegated operations in rapid sequence, the decision must be evaluated at the resource boundary, not assumed from the session boundary. Practitioners should treat authorization as a live enforcement layer, not a one-time entitlement event.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how thin the operational baseline still is for non-human identity governance.
A question worth separating out:
Q: How do teams decide when contextual caveats are better than permanent access?
A: Use caveats when access should depend on request-specific conditions such as time, environment, threshold, or task context. Use permanent relationships only for durable authority. If the condition is temporary or situational, baking it into a long-lived entitlement creates unnecessary privilege and makes review harder.
👉 Read our full editorial: SpiceDB and AI agent authorization: why consistent decisions matter
