Employee access
In the program
- subject
- user:maya
- review
- Q2 · passed
- logged
- IdP · SIEM
Loading
Employee access
In the program
Agent tool call
Outside the program
The copilot used Maya's token. Her quarterly review never saw the call.
Trusted in production
The gap
SOC 2 CC6 and ISO 27001 A.5.15 expect named identities, access reviews, joiner-mover-leaver, and a trail you can replay. That control already exists for employees. A copilot that used Maya's token never appeared in the review that covers Maya. Shared keys fail the human test. An unregistered agent fails it the same way, only faster.
Access control, monitoring, and reconstructable change. Auditors sample who had access, to what, and why, across the report period. That sample is still a sample of people and services. SOC 2
An access control policy you can test: least privilege, named identities, timely revocation, and evidence the control ran. The policy you have is written for employees. ISO 27001
NIST AI RMF, ISO/IEC 42001, and EU AI Act Art. 15 apply the same ask to a principal that never sat in joiner-mover-leaver. The log still has to name who acted for whom. NIST AI RMF
RBAC · ABAC · ReBAC
Roles, attributes, and relationships already describe your human estate. If the agent path uses a different model, or none, it sits outside the program auditors already sample. Most production systems use more than one. Permit runs them on the same check and the same log.
RBAC
Job function to permission. SOC 2 CC6.3 and ISO 27001 A.5.18 start here: a role catalog, joiner-mover-leaver, and reviews that actually drop stale access.
ABAC
Tenant, region, data class, time, risk. HIPAA minimum necessary and GDPR purpose limitation usually need this layer, because a role named "support" is too wide.
ReBAC
Who owns the resource, who delegated the agent, which team the folder sits in. Your apps already need this graph. The agent is a new node in it, not a reason to invent a second model.
The control
You already have an IdP for people. You might have a model-safety stack for the LLM. Neither one decides whether this tool call is allowed for this agent, acting for this person, on this resource.
Hybrid PDP
Cloud authors policy. The edge decides. The log goes to your SIEM.
Local PDP
OPA or Cedar next to the workload. Every call is allow or deny before it runs. OPAL pushes diffs instead of nightly reloads.
Subject graph
RBAC, ABAC, and ReBAC on the same engine. Each hop can only narrow authority. If the agent uses a different check, it is outside the estate you already report.
Decision log
Identity, action, resource, outcome, reason, policy version. SOC 2, ISO 27001, GDPR, and HIPAA reviewers already know how to read that.
const allowed = await permit.check(
agent,
"invoke",
{
type: "tool",
key: "export_records",
tenant: user.tenant,
}
);allow · policy v184
ops-copilot on behalf of maya. Scope includes export_records. HIPAA minimum necessary on this tenant.
Where the decision runs
Permit Cloud is the control plane. The Edge PDP evaluates in your VPC. Apps and APIs already hit a check. The agent tool call has to hit the same one, or you have two estates. Live decisions do not depend on us being up. The hosted Cloud PDP is not the deployment we recommend for ABAC.
Local PDP
Sidecar, cluster, or a sharded fleet. Decisions stay in your VPC.
Policy as code
The editor and Git share a source of truth. OPAL ships the diff.
RBAC, ABAC, ReBAC
One engine. The agent tool call has to hit the same check the app already hits. The Cloud PDP is not the ABAC path we recommend.
Hybrid
Permit Cloud authors policy. If the PDP cannot answer, fail closed.
Auditing
SOC 2 Type II samples the trail across the report period. ISO 27001 A.8.15 calls it logging. HIPAA 164.312(b) calls it an audit control. A useful authorization log names the subject, the action, the resource, and the reason. A quarterly access review reconstructs Maya's quarter. It cannot reconstruct the copilot's tool calls unless those calls hit a PDP. For agents, traces are not enough.
Who
The subject that asked, and the human it acted for when the subject is an agent.
What / which resource
The action and the object. A role name without a resource is not enough for an access review.
Allow or deny
The decision, plus a human-readable reason and the policy version that produced it.
When, for the SIEM
Stdout from the PDP, searchable in the dashboard, exportable into Splunk, Sentinel, or Chronicle. We do not claim one-click native connectors.
The agentic era
Identity registered the human, and IAM still reviews that human. The copilot that used their session is a different principal. Authorization decides the action. Bind the agent to the delegating person, limit it to a subset of their permissions, and log every tool call. Until then you have human access control sitting next to an ungoverned agent path. Roles as the outer boundary, relationships for the resource.
Human delegation
Bring your IdP. Grant a subset of a person's permissions. That is how you enforce HIPAA minimum necessary and GDPR purpose limitation on a copilot, the same way you already cap a support role.
Agent to agent
A may call B only for resource R on behalf of user U. Each hop can only narrow. ReBAC is the model; the PDP is the check. A chain of service accounts is not that graph.
Intent check
If the tool call drifts from the delegated job, deny it. High-risk tools can wait for a human. Prompt policy cannot do this; the human access review cannot either.
One estate
Identity, attributes, relationships, context. A parallel agent-governance stack leaves the gap in place. The agent path belongs on the same check API.
Global first · local when it applies
Hold SOC 2 and ISO 27001 everywhere. Add NIST AI RMF and ISO/IEC 42001 when agents are in the path. Add GDPR, HIPAA, the EU AI Act, and the rest when you operate there or serve people who live there.
Always in view
Horizontal frameworks. What each one wants, and what the check produces, regardless of HQ.
CC6 access control, monitoring, reconstructable change. Identity, action, resource, outcome, and reason on every check.
A.5.15 access control and A.8.15 logging. Least privilege you can test. The Edge PDP is the control. GitOps is the change record.
Govern access to AI systems. Measure incidents. A PDP on every agent action, plus the log, is the technical control.
Operational controls inside an AI management system: versioned policy and decision logs. Permit.io is not ISO 42001 certified. The evidence maps into yours.
The agent must not exceed the requesting user. EU AI Act Art. 15 is the high bar a lot of global buyers use. ReBAC plus a PDP the model cannot talk past.
If you operate there, or serve customers there
These apply when you operate there, or when you serve people who live there.
You process personal data of people in the EU/EEA, wherever you sit. Purpose limitation and demonstrable access, enforced at the API or tool call.
You place or use in-scope AI in the Union, or you sell into buyers who do. Art. 15 privilege management is the PDP, not the model.
PHI as a covered entity, a BA, or a vendor to health customers. Minimum necessary, per resource, with an audit trail under 164.312(b).
California residents and similar state privacy regimes. Reconstructable access to personal information a user, service, or agent touched.
APRA-regulated, or you serve customers who are. Preventative IAM for non-human actors, including when Permit Cloud is unreachable.
Commonwealth AI use cases, or Australian personal information in the path. A documented control that ran.
Vendor attestations
Permit.io is SOC 2 Type II attested (January 2026), with a HIPAA BAA and GDPR/CCPA commitments in the Trust Center. Those documents describe us as a vendor. They do not replace the logs your own applications and agents have to produce.
The control runs next to the workload: sidecar, cluster, or sharded. AuthZen-compatible APIs. Decisions do not leave the VPC.
PDP overviewAuthor in the UI or Git. A revocation lands on every PDP without a bundle reload, which is reconstructable change for SOC 2.
How Permit worksWho, which agent, what action, which resource, allow or deny, and a human-readable reason. Ship it to the SIEM you already run.
Audit log docsSCIM, Okta, Auth0, Entra-compatible agent identity. Your IdP authenticates. Permit authorizes the action those tokens still have to pass.
MCP Gateway docsFrom the blog
Longer pieces on the models, the logs, and what changes when the subject is an agent.
When each model is the right fit, and why most production systems end up using more than one.
What a useful authorization log actually contains, and how that maps to SOC 2, HIPAA, and ISO 27001.
Entra Agent ID and SD-JWT register the principal. Runtime policy still has to decide the tool call.
Roles as the outer boundary, relationships for delegated, per-resource checks.
Traces are observability. Accountability needs who delegated, which policy allowed it, and what happened next.
The questions procurement already asks, applied to agent traffic.
FAQ
Next
Bring the inventory: apps, APIs, and the agents that now call them. We map SOC 2, ISO 27001, and the AI overlays onto one Policy Decision Point.