Traditional identity models assume that once a user or service is authenticated and authorized, the system trusts them to act within declared boundaries. A human employee with access to the customer database can read customer records. A service account with write permissions to an S3 bucket can upload files. Identity is binary: access granted or denied.
AI agents require a new model. An agent’s behavior is contingent on input, training, and real-time context in ways that human behavior is not. An agent may have been authorized to perform an action, yet new information or environmental factors could mean that execution is no longer appropriate. Runtime control—the continuous verification and constraint of agent actions during execution—emerges as a new identity class.
Runtime control asks: Is this agent authorized to perform this specific action, with these specific parameters, right now? It is identity checking happening per-action, not per-session. For agents, it is not enough to verify that an agent is who it claims to be; the system must verify that the action it is about to take aligns with its purpose and constraints.
This is distinct from traditional authorization. A human employee might be authorized to “approve purchase orders up to $50,000.” That rule is enforced by governance policy and checked once at system entry. An agent executing procurement workflows requires the same rule, but with tighter boundaries: “Approve purchase orders for [these vendors], in [these categories], up to [this amount], after [these verification steps].” And crucially, that rule must be enforced in real time as the agent decides to approve each order.
Technical implementation requires isolation and observability. The agent must run in a confined environment where its system calls and API invocations are intercepted and validated. Kernel-level monitoring, container isolation, service mesh proxies, or API gateways become identity enforcement points. If an agent attempts an unauthorized action, it is stopped before execution.
The governance burden is substantial. For a human, authorization rules are relatively stable. They change when the person is promoted, changes teams, or leaves the organization. Agent authorization rules may need to change based on the agent’s current task, the market conditions it is observing, or the outcomes it has achieved so far. This requires dynamic identity policy—rules that adapt in real time.
Responsibility for runtime control is fragmented. In cloud environments, infrastructure operators cannot assume that application teams have implemented runtime controls. Application teams cannot assume that infrastructure provides them. This gap must be eliminated. Runtime control for agents must be viewed as a shared responsibility with enforcement points at every layer.