Patterns for placing the authority check.
Identify where agent, tool, API and machine workflows cross from intent into an external effect.
- Input
- principal + task + action
- Check
- authority + policy + context
- Output
- decision + evidence
- 01 capture
- principal + task + operation
- 02 resolve
- authority origin + parent chain
- 03 evaluate
- policy + fresh trust context
- 04 enforce
- ALLOW / DENY / ESCALATE / DEGRADE
- 05 correlate
- decision + executor + observation
Place the check at the last boundary that can prevent the effect.
Enforcement points
Agent → Tool and Agent → API
A tool wrapper can check an agent’s grant before a privileged tool executes. An API gateway or application boundary can check the operation and target before an endpoint commits a change. Both require reliable principal attribution; a shared credential alone may hide the actual agent.
A tool-level check is insufficient if the agent can reach the same API directly. Inventory bypass paths before treating one interception point as complete.
- Agent → Tool
- Agent → API
- Agent → Agent → Tool
- Security Agent → Remediation System
- Machine Controller → Physical System
Cross-runtime handoff
Delegated and domain-specific paths
For Agent → Agent → Tool, each handoff should create a narrower child grant and carry the authority chain to the final tool. A security agent requesting remediation should be checked against incident scope before SOAR, EDR or identity tooling performs the action.
A machine controller requesting physical movement needs local safety checks independent of authority policy. The authority layer can determine whether the task is permitted, but must not bypass interlocks or domain control systems.
Partial failure
Design for partial failure
Each pattern needs an answer for decision-service unavailability, stale signals, revocation delivery, retry behavior and duplicate execution. Retrying a denied request must not create a new grant. Retrying an allowed action should not accidentally execute it twice.
These are architecture patterns. ProofGrid has not published universal adapters or code snippets for every named category.
Find bypasses and asynchronous hops
A tool wrapper may enforce policy, but an agent may also reach the underlying API through a direct HTTP client. A queue may delay execution until after a grant is revoked. A privileged helper service may obscure the original agent. An integration diagram should mark each path and the point that can still block the effect.
When a protected action crosses an asynchronous hop, the worker needs a trustworthy reference to the principal, task and grant. It should reevaluate facts that can change, not rely only on the decision made when the job was queued.
Integration Review