This matches what I keep telling clients who think a well-trained model is the safeguard. Authorization has to live in a layer the model can't talk its way around. The tiered approach from session binding to real authentication is the right order too. Most teams try to skip straight to the hard part and wonder why it doesn't hold.
Chris, Josh, agreed. “Can’t talk its way around” also needs to mean “can’t connect around”. An external authorisation check only holds if the agent and its tools can’t use another route to the resource.
Josh, your use of OpenZiti for segmentation in ATF is a practical connection here. Identity-Defined Reachability makes specific identity-to-service relationships the basis for connectivity, with application controls governing permitted actions and runtime evidence informing whether authority should continue.
I’d test both sides: remove the builder’s containment and check that service-owner controls still prevent unauthorised access, then withdraw an allowed relationship and measure when existing and new connections stop. That gives us evidence the boundary holds even when the agent doesn’t cooperate.
This matches what I keep telling clients who think a well-trained model is the safeguard. Authorization has to live in a layer the model can't talk its way around. The tiered approach from session binding to real authentication is the right order too. Most teams try to skip straight to the hard part and wonder why it doesn't hold.
Chris, Josh, agreed. “Can’t talk its way around” also needs to mean “can’t connect around”. An external authorisation check only holds if the agent and its tools can’t use another route to the resource.
Josh, your use of OpenZiti for segmentation in ATF is a practical connection here. Identity-Defined Reachability makes specific identity-to-service relationships the basis for connectivity, with application controls governing permitted actions and runtime evidence informing whether authority should continue.
I’d test both sides: remove the builder’s containment and check that service-owner controls still prevent unauthorised access, then withdraw an allowed relationship and measure when existing and new connections stop. That gives us evidence the boundary holds even when the agent doesn’t cooperate.