Correct Authorization, Wrong Decision

What Zero Trust for AI agents cannot determine before an agent acts.

Anthropic has published a security framework for deploying autonomous agents in the enterprise. It is a serious document, and it is correct about the threat model. Agents are not ordinary software. They interpret goals, select tools, and execute multi-step operations without human review at each step. Perimeter assumptions do not hold against systems that act with that much autonomy, and ordinary access control does not prevent an agent from misusing permissions it was legitimately granted. The framework's response is Zero Trust: verify every request, assume breach, grant the minimum necessary, and extend least privilege into least agency so that each agent tool can do only what its function requires.

We agree with the substrate. This piece is about the layer above it.

Two different questions

Zero Trust answers a security question with great precision. May this identity access this resource? It establishes that the caller is who it claims to be, that its credentials are short-lived and cryptographically rooted, that its environment is isolated, and that its actions are logged and attributable. Those are necessary properties. A consequential agent deployment without them is indefensible.

There is a second question that sits next to the first and is not the same question. May this AI-mediated action occur under the applicable policy, given the evidence and constraints in force, before it executes? Call the first security authorization and the second governance authorization. They are related. They are not interchangeable. A cryptographically identified agent operating inside its least-privilege scope can still propose an action that policy does not permit. Verifying the caller is not the same as authorizing the act.

The framework comes close to this boundary in one place. Its most mature tier calls for authorization evaluated at each action rather than at session start, adjusted as risk indicators change. That is the right direction, and it confirms what regulated deployments will require. But continuous re-evaluation of access is still access control. It is not a recorded verdict on a specific proposed action, bound to a governing policy, that can be reconstructed afterward. Moving authorization to the moment of action is necessary. It does not by itself produce the object that governance needs.

The missing object is the verdict

Governance requires a decision on the action itself, emitted before the action runs, in a defined verdict space: ALLOW, DENY, or ABSTAIN.

ABSTAIN is the verdict that security frameworks lack, and it is the one that matters most. ABSTAIN is not an escalation. It is not a polite way of routing an uncertain case to a person. It is an execution-blocking state the system enters when it does not have sufficient basis to authorize, and it is recorded as its own authorization event. The human override that resolves an ABSTAIN is itself an authorization event, signed and recorded, not the absence of one. A framework that handles uncertainty by sending the case to manual approval has built a workflow path. It has not produced a verdict, and it cannot later prove that the action was decided rather than merely permitted to proceed.

Least agency lives one level below this. It constrains what an agent can do in general. The verdict decides whether a particular proposed action is permitted now. Least agency is necessary. It is not sufficient, because an agent acting entirely within its agency can still propose something policy forbids.

The missing evidence is the artifact

The framework is right to insist on logs, traces, provenance chains, and replay of agent decisions. Those capabilities are necessary, and a regulated deployment cannot operate without them. But they are observational. They reconstruct what the agent did. They do not, on their own, prove that the action was authorized before it happened.

An authorization artifact is a different object. It is a record bound to the action that is replayable from the recorded inputs and parameters: which policy applied, what the gate saw at decision time, and what verdict it returned.

Decision replay shows behavior. Verdict replay shows authorization.

The distinction is the one a regulator, an auditor, a board, or a counterparty will eventually press on. If the strongest thing a system can produce after the fact is a faithful reconstruction of what occurred, it has observability. If it can produce a reconstructable verdict that was emitted before execution, it has authorization. Those are not the same evidentiary standard.

The harder problem the framework's own test exposes

The framework offers a design test that is worth adopting in full. When you evaluate a control, ask whether it makes the attack impossible or merely tedious. Controls whose value is friction degrade against an adversary with unlimited patience. Prefer a barrier that removes a capability over one that throttles it.

Apply that test to authorization and a deeper problem appears. A verdict is only as sound as the provenance of what it authorizes. In an agentic setting the same agent that proposes an action can also produce the inputs the policy evaluates. Consider a loan-underwriting agent. The agent extracts income from uploaded documents, computes a debt-to-income ratio, and submits the result to an authorization gate. The gate evaluates the policy correctly. The verdict is signed. The artifact is replayable. The audit trail is complete. The loan is still approved on fabricated evidence if the gate cannot determine where the income figure originated. Every control worked. The decision remains unsound. The confused-deputy and context-poisoning failure modes the framework catalogs reappear here, not as security incidents to be detected after the fact, but as authorization inputs that were never admissible in the first place.

Observability reconstructs this after the fact. By the framework's own measure, that is the tedious side of the line. The harder and more durable control is admissibility decided before evaluation: when the origin of a load-bearing input cannot be attested, the gate abstains and the action never runs. That is the impossible side of the line, and it is the open frontier of authorization architecture. It is where our work is concentrated.

Where the layers sit

These are not competing claims. They are layers, and a serious agent deployment needs all of them.

Zero Trust secures the agent. Execution-time authorization governs the action. Authorization that cannot establish the provenance of its inputs is authorization in form, not in substance. The first establishes the caller's identity and operating context. The second establishes that the act is permitted under policy before it occurs, and that the inputs the policy weighed were entitled to be weighed at all.

The enterprise conversation is moving in the right direction, away from perimeter assumptions and passive monitoring and toward runtime control of autonomous systems. The framework is a good account of the security substrate that shift requires. The next architectural distinction is the one inside authorization itself. Zero Trust verifies the agent. Authorization governs the action. The decisive question for regulated AI is not only whether the caller is trusted. It is whether the action was authorized, before it ran, on evidence that was admissible.

That is the layer FERZ is building.