An AI agent is a software system that acts autonomously or semi-autonomously for a person, organization, or system. It works toward a goal by reasoning about available options, selecting tools, and using results to adjust its next action. Unlike predictable application flows, an agent may take different action sequences for the same kind of task as conditions and information change. section 18.0 section 18.1
Agents become operationally useful when they reach beyond the model itself. A tool invocation can retrieve documents, query a database, call an internal API, or trigger a workflow. Structured interfaces expose a tool name, description, and input schema; the surrounding integration translates that request into a system-specific operation. section 18.2
{
"name": "documents.search",
"description": "Search customer documents available to the current task.",
"inputSchema": {
"type": "object",
"properties": {
"customerId": { "type": "string" },
"query": { "type": "string" }
},
"required": ["customerId", "query"]
}
}
The document-search tool definition illustrates the structured capability an agent sees: a named operation with required customer and query inputs, rather than a custom API implementation. section 18.2
Agent behavior creates distinct authorization concerns:
- Dynamic planning means the agent chooses actions at runtime and can revise its plan as it obtains information. section 18.1
- Tool-based execution can place sensitive data and critical systems within the agent’s reach. section 18.1
- Adaptive behavior makes static assumptions about an application’s fixed path insufficient; proposed actions require contextual evaluation. section 18.1
- Delegation and subagent authority need explicit, bounded policy rather than inferred trust. section 18.0 section 19.7
A policy-aware agent loop embeds authorization before tool execution. A policy enforcement point sends the proposed action to a policy decision point, which evaluates whether it is permitted under current conditions. This follows zero-trust principles: authority is checked continuously, not assumed because the request came from a valid agent account. section 18.1 section 18.2
Avoiding policy probes
An agent seeking credential files can ask the policy system about the restriction before attempting access. A constraint-aware result tells it that the operation is not permitted, so it incorporates the limit into its plan instead of repeatedly trying denied paths. This reduces risky requests and wasted work. section 18.4.3
Runtime controls do more than block actions. Denials can feed back into planning, allowing agents to explore within clear boundaries while remaining subject to the same policy framework as employees and applications. Centralized decision logic also supports consistent governance across multiple agents and external systems. section 18.3.4 section 19.3
