Notifications
Clear all
Topic starter
10/06/2026 11:26 pm
TL;DR: Externalized authorization still breaks when teams rebuild context differently in every application, especially as AI agents enter the decision path, and Cerbos Synapse adds a data integration layer in front of its policy engine so identity, resource, and relationship data can be enriched before each authorization decision, reducing per-service plumbing and making context resolution auditable according to Cerbos.
NHIMG editorial — what this means for AI and NHI governance
Questions worth separating out
Q: How should security teams centralise authorization context across applications?
A: Security teams should centralise attribute assembly in a governed layer that serves both applications and infrastructure enforcement points.
Q: Why do AI agents complicate authorization decisions for IAM teams?
A: AI agents complicate authorization because they often do not carry a complete human identity context by default.
Q: What breaks when authorization data is rebuilt in every service?
A: When each service rebuilds authorization data independently, policy becomes dependent on local middleware, upstream API changes, and team-specific assumptions.
Practitioner guidance
- Inventory every attribute source used in authorization decisions Document which systems provide principal, resource, and relationship data today, then mark where each service rebuilds the same joins in custom middleware.
- Move context resolution out of application code Route authorization requests through a shared enrichment layer so changes to IdP mappings, resource metadata, or relationship lookups happen once and are visible to security and compliance reviewers.
- Model delegated agent requests separately from human requests Require the policy input to include the agent identity, the delegating human, and the resource in one transaction so access checks reflect the actual delegation chain instead of a partial caller ID.
What's in the full announcement
Cerbos's full announcement covers the operational detail this post intentionally leaves for the source:
- Declarative integration patterns for Envoy, Kafka, Trino, and Kubernetes using the protocols they already expose
- The full request-path architecture for proxy extensions, route extensions, and policy evaluation with enriched attributes
- Implementation detail on caching, fallback behaviour, and OpenTelemetry traces across the authorization flow
- Examples of identity provider enrichment and graph-based access control that are not expanded here
👉 Read Cerbos's announcement on Synapse for centralized authorization context →
Authorization context enrichment for AI agents and human IAM: what changes?
Explore further
12/06/2026 5:23 am
Authorization context is the hidden control plane of externalized access decisions. The article describes a common enterprise failure pattern: policy engines are asked to decide with incomplete or locally assembled data. That creates drift between applications, makes audits depend on code inspection, and turns every identity source change into a distributed rework exercise. The practitioner lesson is that context governance is now as important as policy authoring.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: How can organisations reduce authorization drift between gateways and applications?
A: Organisations can reduce drift by forcing both gateway enforcement and application enforcement through the same context resolution and policy evaluation path. That way, perimeter checks and in-app decisions use the same attributes, the same freshness rules, and the same audit trail.
👉 Read our full editorial: Cerbos Synapse centralises authorization context for AI and human requests
