Treat AI agents as privileged NHIs: distinct identity, least privilege, attributable delegation, and forensic decision logs, not shared keys. Map to NIST NCCoE's identification · authorization · delegation · logging.

Permit.io vs Cerbos, plus Cerbos alternatives: both run an open source policy decision point next to your app. Managed control plane vs self-hosted PDP, with a table and when to choose each.

For human-to-agent delegation, bind human principal, agent ID, tools, data, policy decision, and HITL, not just tool traces, into an attributable audit trail.

Oso Cloud acquired by Tiny (announced Oct 6, 2026), most of the team joined Temporal. A practical guide to Oso alternatives, mapping Polar to RBAC, ReBAC and ABAC, and migration planning.

AI agent authorization checks every agent action against policy, delegation, resource and context. Add per-action checks, trust ceilings and decision logs.

What ISO 42001 certification involves: the AI management system, accredited certification bodies, stage 1 and 2 audits, Annex A controls, and agent evidence.

EU AI Act logging requirements under Article 12 for high-risk AI systems, log retention rules (at least six months for deployers under Article 26(6)), ISO 42001 A.6.2.8, and practical logging design for AI agents.

What an authorization service does, when to use one instead of building your own, and a 2026 comparison of 7 authorization as a service providers: Permit.io, Cerbos, AuthZed, Auth0 FGA and more.

Production authorization enforcement requires four pillars: a policy decision at every sensitive action, granular policy models, realtime revocation, and auditable decisions. Control plane to OPAL to PDP to PEP to logs is the architecture that makes them work together.

AI agent audit logs need about twelve fields: identity, delegation, tool, resource, policy, decision, HITL, and outcome.

AI agent audit trail guide: record identity, delegation, tool, resource, policy version, allow or deny, HITL approval and outcome for every agent action. Tool traces are not enough.

SOC 2 CC6.1 access control checklist for AI agents: what CC6 and CC7 assume, how agents break them, ISO 27001 mapping, and the evidence to produce.