Topic starter
24/06/2026 9:08 pm
TL;DR: JWTs cannot carry the live delegation, transitive permissions, or runtime context AI agent workflows need, according to PermitIO. Agent access has to be decided in real time, or inherited authority will drift beyond the approved scope.
Editorial analysis by NHI Mgmt Group, based on content published by PermitIO: “Why JWTs Can’t Handle AI Agent Access”.
Key questions
Q: Why do agent workflows need more than static policy enforcement?
A: Agent workflows need more than static policy enforcement because the security problem changes as the workflow moves from input to action to output.
Q: What do security teams get wrong about embedding more data in JWTs?
A: They assume a larger token can solve a governance problem that is actually about dynamic relationships.
Q: What breaks when JWTs are used for AI agent authorization?
A: JWTs break when an AI agent needs to act on changing context, delegate to other agents, or inherit access across a chain of relationships.
Practitioner guidance
- Map delegation chains explicitly Inventory where users hand authority to agents, where agents hand work to other agents, and which resources each hop can reach.
- Move authorisation checks to request time Use a policy decision point to evaluate current actor, resource, and relationship state on each sensitive action instead of trusting fixed claims until token expiry.
- Limit JWTs to identity signals Treat tokens as pointers to relationships rather than complete permission payloads.
Bottom line: AI agent workflows expose a structural weakness in JWT-based authorization because fixed claims cannot keep pace with delegation, context shifts, or changing relationships.
Glossary terms: Agentic Authorization Bypass, Delegation Chain, Policy decision point, Relationship-Based Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
25/06/2026 6:11 am
Static authorization tokens are a poor fit for agentic delegation: JWTs were designed for claims that remain stable long enough to be reused safely, but delegation chains in AI systems mutate during execution. That assumption fails when the actor can hand off work, inherit scope, or change context mid-session. The implication is that agent authorization has moved beyond token validation and into live policy evaluation.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations keep delegation chains accountable in multi-agent workflows?
A: They need every hop to preserve traceability back to the original human request and approved scope. That means using delegated authorisation, proof-of-possession controls, and auditable policy decisions so downstream actions cannot silently acquire broader authority than the request justified.
👉 Read our full editorial: JWTs fail for AI agent access because authorization is static