Reviewed and updated October 8, 2026.
Before an agent can read a record or change a system, decide whose authority it uses. A shared administrator credential makes every user request a request with administrator powers. A prompt asking the model to respect permissions does not change those powers.
The design decision is whether the task needs delegated user access, a narrowly scoped service identity, or no execution authority at all. A drafting assistant may need only approved reference material. An assistant that updates a customer record needs a separate authorization decision for that action and record.
Authentication establishes identity; authorization determines permitted operations. OWASP's authorization guidance recommends least privilege, denial by default and permission checks on every request. Apply those checks in the backend that reads the object or executes the action, outside the model's generated plan.
Record the initiating user, tenant, executing service, requested operation and target resource. Obtain tenant identity from trusted session or identity infrastructure. Do not accept a tenant identifier produced by the model as proof of membership. Tool names and input schemas describe an interface; they do not grant permission to use it.
Where the identity platform supports delegation, OAuth Token Exchange, RFC 8693, provides subject and actor concepts and audience and scope parameters. Whether a deployment issues a composite token depends on its policy. The standard does not automatically propagate revocation from an input token to an exchanged token.
Consider an assistant that helps a finance employee review invoices for their organization. This is a proposed configuration, not a report of a tested deployment.
Keep credentials in the execution service rather than the prompt or transcript. Limit issued credentials to the necessary resource audience, operations and lifetime. Define how account removal, role changes and incident response invalidate active access. Test this behavior against the identity platform actually used; short expiry alone does not establish immediate revocation.
Try a valid invoice ID from another tenant, a revoked employee, a token for the wrong audience and a changed proposal after approval. Each unauthorized request must be denied without protected data in the response or logs. Separately, retry the same approved operation after completion: it must cause no second effect and may return the recorded prior result, subject to current authorization. Record identity, policy decision and operation outcome with access-controlled logs, without recording raw credentials.
MCP integrations also need their own audience and consent checks. The MCP security guidance forbids accepting tokens issued for other resources and passing them unchanged downstream. A protocol adapter is not a substitute for application authorization.
A service identity can be appropriate for a scheduled task over one approved dataset, but it needs a named owner and explicit scope. Delegation better represents user-specific work when the platform supports it. Keeping the assistant in draft-only mode is a useful alternative when reliable action authorization is unavailable.
These controls limit particular access paths. They do not eliminate credential theft, policy mistakes, vulnerable tools or prompt injection. Check retrieval permissions separately, including caches and citations.
For an integration that needs a clear identity and action boundary, review ALLTIPLY's custom AI development scope. Request a project review with the systems, user roles and actions the assistant would need.
Optional Google Analytics stays off until you choose Accept analytics.
