Authorization Before Action: A Reference Architecture for Tool-Using AI Agents

An assistant that reads external content and invokes a write-capable tool crosses a security boundary that instruction-following accuracy cannot enforce by itself. This white paper develops an implementation-oriented reference architecture for authorizing agent actions before their effects occur. It synthesizes indirect prompt-injection research, agent benchmarks, structured-query defenses and the capability-based CaMeL architecture. The proposed protocol binds an action to an authenticated principal, permitted operation, exact resource scope, approved arguments and execution conditions, then records the observed outcome. It separates semantic task success from authorization, information-flow policy and retry correctness. A hypothetical procurement example and a fault-and-attack evaluation matrix make the design reviewable. No implemented system, novel capability-security primitive, universal injection defense or new experimental result is claimed.

Artificial Intelligence Cloud Computing Software Engineering