Fine-Grained Authorization (for agents)

Authorization evaluated per action against externalized policy, rather than granted once as a coarse OAuth scope. Traditional scopes like `calendar.read` were designed for apps a human drives click by click; an autonomous agent making hundreds of unattended tool calls needs a policy decision on each one, evaluated outside the agent's own code so a hijacked agent can't rewrite its own rules. The pattern is the zero-trust Policy Enforcement Point / Policy Decision Point split (a gate in front of the tool asks a separate service 'is this allowed?'), which the OpenID Foundation's AuthZEN Working Group is standardizing an interface for. A stronger variant is deterministic pre-action authorization — checking a proposed tool call against policy *before* it executes, which is the correct shape for irreversible actions. Deployable-today approximations: per-resource scoped tokens, audience binding, and human-in-the-loop approval for high-consequence actions.