Back to Glossary
PROTO

Authority Control

principal authorizationtool allowlistVEX Authority pillar

Authority control is the mechanism by which every agentic action is bound to an authorized principal and a declared scope.

THE IMPLICIT AUTHORIZATION PROBLEM

Most frameworks assume implicit authorization. This breaks under Indirect Injection or multi-agent delegation. Authority control transforms authorization from an implicit assumption into an explicit claim.

PROTOCOL CONTEXT (VEX — AUTHORITY PILLAR)

The Authority pillar governs which tools and actions are permitted for a given execution context. Authorization is preserved through the execution lifecycle and validated before consequence.

ProvnAI Mitigation

McpVanguard evaluates tool calls against the active policy boundary. Tool identifiers not listed in the configured policy are blocked. More advanced delegation and trust-context handling depend on deployment configuration and adjacent governance layers.