Authorization for AI Agents: Beyond RBAC. Capability Tokens, User-Context-Aware Policy, and the Limits of Roles

Key Points

• The research aims to develop an advanced authorization framework for AI agents that surpasses traditional RBAC methods.
• Developed the AAC framework focusing on Authenticate, Authorize, and Communicate components.
• Evaluated authorization strategies in real-time against agent capabilities and user contexts.
• Analyzed the limitations of existing role-based access control in dynamic environments.
• Proposes a new model that enhances security by evaluating agent permissions in real-time.
• Identifies key factors in user delegation affecting task authorizations.
• Highlights the limitations of fixed roles in managing non-human identities effectively.