Fine-Grained Authorization (for agents)
Authorization evaluated per action against externalized policy, rather than granted once as a coarse OAuth scope. Traditional scopes like `calendar.read` were designed for apps a human drives click by click; an autonomous agent making hundreds of unattended tool calls needs a policy decision on each one, evaluated outside the agent's own code so a hijacked agent can't rewrite its own rules. The pattern is the zero-trust Policy Enforcement Point / Policy Decision Point split (a gate in front of the tool asks a separate service 'is this allowed?'), which the OpenID Foundation's AuthZEN Working Group is standardizing an interface for. A stronger variant is deterministic pre-action authorization — checking a proposed tool call against policy *before* it executes, which is the correct shape for irreversible actions. Deployable-today approximations: per-resource scoped tokens, audience binding, and human-in-the-loop approval for high-consequence actions.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 9, 2026
Frequently asked questions
- Why not just use OAuth scopes?
- Scopes are static and coarse — they say what an app *may* do over a whole session, not whether *this* specific action is appropriate right now given context. An agent with `email.send` scope can be prompt-injected into sending a data-exfil email that is perfectly within scope. Fine-grained authorization evaluates the actual action (recipient, content, time, sequence) against policy at call time, catching abuse that scopes permit.