Authorization intersection

How authorization intersection works

Authorization intersection is a dual-control permission model. The effective access decision is the overlap of two independent grants, usually one from the human operator and one from the delegated agent, so neither side can widen scope on its own.

This model is most useful when a mediated action should reflect both user intent and agent capability. It preserves a hard boundary between asking for something and being allowed to do it, which is why it is often treated as the safest baseline for delegated access paths.

In practice, the intersection can be expressed through policy engines, approval gates, scoped delegation, or per-action checks. The important point is not the mechanism label but the control logic, the final permission must be the common subset of both grants.

That makes the model stricter than simple delegation. The agent can act only where the user’s authority and the agent’s authority both already exist, which reduces the risk of accidental privilege expansion.

Why intersection is safer than unilateral delegation

Authorization intersection matters because it limits capability amplification. If an agent is compromised, or if the human request is too broad, the second grant still constrains what can actually be executed.

It also reduces the blast radius of policy mistakes. A broad user entitlement does not automatically become broad agent power, and a powerful agent does not automatically inherit every user permission.

The trade-off is friction. Intersection-based control can block actions that would otherwise be convenient, especially when the two grants are not designed with the same granularity. That friction is usually the point, because it forces explicit overlap rather than silent overreach.

For mediated systems, the strongest version of the model is per-action and task-scoped. Coarse grants weaken the protection because the overlap becomes too permissive to be meaningful.

Common failure modes and design pitfalls

Intersection fails when one side is implemented as a rubber stamp. If the agent grant is effectively “full access” or the user grant is never narrowed to the actual task, the overlap looks safe on paper while still being broad in practice.

Another failure mode is scope drift over time. As tasks evolve, intersection checks can quietly expand if teams keep reusing old policies, shared roles, or default approvals instead of re-evaluating the exact action being authorized.

It also breaks down when systems confuse authentication with authorization. Proving who the user or agent is does not answer what they may do; the intersection only works when both decisions are enforced separately and then combined.

In linked automation flows, the model is only as strong as the least constrained grant. A weak delegated path, a standing token, or an overly broad approval policy can erase the intended overlap.

Where authorization intersection fits in practice

This pattern is best understood as a governance boundary for mediated access. It is not just a theory of permission calculation, it is a way to ensure that delegation remains conditional, reviewable, and bounded by intent.

It is especially relevant for AI-assisted operations, high-impact automation, and any workflow where an agent can take action on a person’s behalf. NHIMG’s AI Agent Authorisation Guide explains how task-scoped access and per-action decisions support that model, while the Authorisation Models Guide places intersection-style thinking in the broader landscape of RBAC, ABAC, ReBAC and policy-based control. For the lifecycle side of governed delegation, IAM and IGA Basics covers how access review, entitlement governance and least privilege keep permission models from drifting.

Risk and Threat Considerations

Authorization intersection is designed to resist privilege escalation, but it can still fail if either grant is too broad or too persistent. The main risk is that a mediated path becomes a back door: one compromised principal, one stale policy, or one overly generous delegation can turn an intended overlap into effective excess access.

Failure mechanism: The overlap is weakened when teams reuse standing entitlements, grant broad agent scopes, or treat approval as a formality instead of a real constraint. That allows the final permission set to exceed the intended task boundary.

Impact: Attackers or careless users can trigger actions that appear mediated but are actually over-permissioned, increasing the chance of unauthorized changes, data exposure, or lateral movement through delegated trust.

Practitioner Guidance

Governance implication: Treat the intersection as a policy design requirement, not an implementation detail. If the user grant and the agent grant are owned by different teams, define which one is allowed to narrow scope, which one must approve, and how exceptions are reviewed.

What to watch for: Broad default grants, long-lived delegated access, and approvals that are not tied to a specific action are the usual warning signs. The safest intersection is the one that remains task-specific enough to be meaningful.

Related resources from NHI Mgmt Group

• What is the difference between intersection and exclusion in fine-grained authorization?
• What are MCP Authorization Extensions and how do they help organizations?
• Why is it necessary to address authorization challenges in AI agent deployment?
• When should organisations use runtime authorization for AI agents?