An agent loop repeatedly plans actions, checks whether each action is permitted, executes allowed actions, evaluates results, and revises the plan when necessary. Unlike a predefined application workflow, an agent’s path emerges dynamically, so authorization must operate continuously rather than at occasional checkpoints. section 18.3
A policy-aware loop places a Policy Enforcement Point (PEP) between the agent and each tool or external system. The PEP builds a Principal, Action, Resource, and Context (PARC) request, sends it to a Policy Decision Point (PDP), and permits execution only when the policy decision allows it. section 18.3
This arrangement gives the loop four operational properties:
- Continuous enforcement checks every proposed action before execution, not only entry into the system. section 18.3.4
- Dynamic adaptability applies policy even when the agent changes strategy between executions. section 18.3.4
- Behavioral feedback turns a denial into planning input: the agent must revise its approach rather than proceed. section 18.3
- Clear operational boundaries let agents explore within defined limits while treating them as another authorized principal. section 18.3.4
Denied tool invocation
An agent proposes reading a document or calling an API. The PEP evaluates the request against Cedar policies. If permitted, the tool runs; if denied, the denial returns to the agent, which revises its plan. The same pattern can allow a customer-support agent to retrieve account information while prohibiting financial transactions. section 18.3 section 18.3.4
Figure 18.2 A policy-aware agent loop. An agent iteratively plans and executes actions while a PEP evaluates each proposed action before execution. Authorization decisions become part of the agent’s feedback loop, allowing it to revise its plan when an action is denied.
Trace the agent’s iterative plan–policy-check–execute cycle and see how authorization decisions become feedback for replanning. section 18.3
