An AI agent audit trail binds identity, delegation, tool, resource, policy, allow/deny, HITL, and outcome. Tool traces are not enough.

SOC 2 CC6 and ISO 27001 access control checklist for AI agents: what controls assumed, how agents break them, evidence to produce.

Regulators’ “prove it” maps to PEP + PDP + decision logs: enforce in the app, decide in a local PDP synced by OPAL, and keep explainable allow/deny evidence.

DORA and NIST do not prescribe a vendor. They expect scoped least-privilege access and attributable logs, including for NHIs and agents. Application FGA with decision logs is how product teams produce that evidence.

AI agent permissions usually inherit the user OAuth token. That fails least privilege. Give the agent its own role at each tool call.

RBAC grants access by role; ABAC evaluates user, resource, and environment attributes. Compare them side by side, see examples, and learn how to migrate from RBAC to ABAC.

Your authorization model shapes least-privilege evidence in access reviews. Role assignments, attribute conditions, and relationship tuples each prove different things.

Hybrid authorization by default: RBAC for org roles, ABAC for context, ReBAC for sharing graphs—one check API across models. How to pick a stack before role explosion, and why least privilege needs explainable entitlements.

Authentication (AuthN) is who you are; authorization (AuthZ) is what you're allowed to do. Learn 401 vs 403, why IdPs don't replace app AuthZ, and how to externalize permissions.

SOC 2-style access reviews need more than IdP login events. Explainable allow and deny decision logs — decision provenance from identity to policy to resource — are the authorization evidence that makes application-level access controls concrete.

Every authorization decision should be explainable. Authorization observability is not more logs — it is decision provenance. Here is how to build an audit trail that answers why access was allowed or denied.

Fine-grained authorization belongs in a dedicated control plane—not scattered if-statements. Learn when to externalize authorization and stop rebuilding DIY RBAC in application code.