Risk-Adaptive Authorization for Agentic AI Systems

Agentic AI systems deploy autonomous agents that execute transactions with delegated authority, yet existing authorization mechanisms rely on static role-based policies that are inadequate for contexts varying in risk. Authentication protocols for ephemeral agents include SPIFFE, OAuth Token Exchange, and DPoP, addressing the question of “who is the agent?” This paper extends that foundation to address “what should the agent be allowed to do?” We present an authorization flow combining workload identity (SPIFFE/SPIRE), token exchange (RFC 8693), policy evaluation (Open Policy Agent), AI-based risk scoring, sender-constrained tokens (DPoP), and CIBA-inspired human approval for high-risk transactions. The architecture implements a three-tier authorization model: Tier 1 transactions receive automatic approval, Tier 2 transactions require supervisor-agent approval, and Tier 3 transactions trigger human-in-the-loop verification. We validate the approach through a retail exchange scenario. Measurements across 120 authorization requests show cold-path latency of 32.7 ms ($S D=18.5 ~\text{ms}$) and warm-path latency of 4.7 ms ($\mathbf{S D}=\mathbf{2. 3 m s}$), a$\mathbf{7} \times$speedup with token caching. Delegation narrowing enforcement blocks all invalid privilege escalation attempts across 20 test cases. The results indicate that risk-adaptive authorization adds acceptable overhead for agentic systems while enabling contextual policy decisions and human oversight for high-risk operations.