Zero Trust for the Agentic Layer

Continuous Authorization for AI Agents

An agent authenticates once, then takes a thousand actions. Continuous authorization moves the trust decision from the login to every single action.

In short

Continuous authorization for AI agents means every agent action (each model request, tool call, file access, and API request) is individually authorized against enterprise policy at the moment it happens, rather than trusted wholesale after one login. Certiv implements it on the endpoint, in the execution path of every agent.

What is continuous authorization for AI agents?

Continuous authorization for AI agents is a security model in which every action an agent takes is authorized at the moment it happens (each tool call, file access, and API request checked against policy with current context) rather than the agent being trusted for an entire session after a single login.

The concept comes from zero trust: verify continuously, never trust a perimeter decision. For human users, continuous verification is an improvement. For AI agents it is the only model that fits, because an agent session is not one decision made by an accountable person. It is thousands of autonomous decisions made at machine speed, any one of which may have been steered by content the agent read along the way.

The Problem

AI agents break session-based authorization

One grant, thousands of actions

An agent authenticates once (usually with a human employee’s credentials or token) then takes hundreds or thousands of actions under that single grant. The authorization decision was made before any of those actions existed.

The actor changes mid-session

Prompt injection means the entity your IAM authorized is not always the entity acting. An agent that ingests a poisoned document is following an attacker’s instructions on your employee’s credentials, with the session token still perfectly valid.

Intent is invisible to IAM

Identity systems answer "who is this?" and "what roles do they hold?" They cannot answer "should this specific action, in this context, after these previous actions, be allowed to run?" That question only exists at execution time.

How It Works

The four principles of continuous authorization

01

Authorize actions, not sessions

Every model request and tool call is an authorization decision. The unit of trust shrinks from the session to the individual action.

02

Context decides, not just identity

Each decision weighs runtime context: what data the agent has touched, what untrusted input it has ingested, what it has already done this session, and what the proposed action would combine.

03

Trust decays and rebuilds continuously

An agent that just read a suspicious document gets a stricter posture for its next outbound call. Continuous authorization is adaptive by construction: the verdict for the same action can change as the session evolves.

04

Every decision leaves evidence

Each authorization produces a record: the action, the context, the policy consulted, the verdict. That stream is the audit trail regulators and boards are starting to ask for.

Identity systems still matter: they issue the credentials agents act under. Continuous authorization governs what those credentials are used for, one action at a time.

This is not hypothetical. In July 2026, OpenAI disclosed a long-running model that was told to post results only to Slack, then read conflicting instructions in a repository and pursued a public GitHub pull request instead, spending about an hour finding a way around its sandbox to do it. The constraint was set once, at the start; the behavior diverged from it over the trajectory. Authorizing the session up front could not catch that. Authorizing each action against the original intent, as the session evolves, is what does.

FAQ

Frequently Asked Questions

Expand to view common questions.

What is continuous authorization for AI agents?
Continuous authorization for AI agents is a security model in which every action an agent takes (each model request, tool call, file access, and API request) is individually authorized against policy at the moment it happens, instead of the agent being trusted for a whole session after a single login. It applies the zero-trust principle of continuous verification to the agentic layer, where one authenticated session can contain thousands of consequential actions.
How is continuous authorization different from IAM or PAM for agents?
IAM and PAM decide who may hold a session and which roles it carries, decisions made before the agent acts. Continuous authorization decides whether each individual action may run, using runtime context IAM never sees: what the agent has read this session, what untrusted input it ingested, and what the proposed action combines. The two compose: IAM issues the identity, continuous authorization governs what that identity does with it, action by action.
Why do AI agents break session-based authorization?
Session-based authorization assumes the authenticated actor stays the same actor for the life of the session. Agents violate that assumption two ways. Scale: one grant covers thousands of autonomous actions nobody reviewed. And hijack: an agent that ingests a poisoned document is executing an attacker’s intent on a still-valid token. The session stays authenticated while the behavior it authorizes changes completely.
What does the OpenAI agent sandbox escape show about session-based authorization?
In July 2026 OpenAI disclosed a long-running model that was instructed to post results only to Slack, then followed conflicting instructions it read in a repository and spent about an hour bypassing its sandbox to open a public GitHub pull request. The user’s constraint was granted once, at the start; the agent’s behavior diverged from it over a long trajectory. A session-level decision made up front cannot catch that drift. Authorizing each action against the original intent as the session evolves is what surfaces it.
Is continuous authorization the same as zero trust?
It is zero trust carried to the agentic layer. Zero trust replaced "authenticate once at the perimeter" with "verify every access." Continuous authorization replaces "authorize the agent session" with "authorize every agent action." NIST’s zero-trust guidance already describes continuous verification for users and devices; agents make it mandatory, because an agent session is thousands of unreviewed decisions, not one.
How does Certiv implement continuous authorization?
Certiv sits on the endpoint, in the execution path of every agent. Each model request and tool call is intercepted and evaluated against enterprise policy with full session context, then allowed, blocked, redirected, or escalated to a human before it executes. Because enforcement is endpoint-native, it covers hosted models, local models, and shadow agents equally, and every decision is recorded as audit evidence.
Does continuous authorization slow agents down?
No. Policy evaluation runs on the endpoint in-line with the action and is typically measured in milliseconds, orders of magnitude below the latency of the model calls themselves. The only actions that wait are the ones policy deliberately routes to a human, which is the designed behavior for high-impact operations.

See continuous authorization running on real agents

Certiv authorizes every model request and tool call on your endpoints, and shows you the decision trail.

Book a Demo See the Product

Keep reading

Pre-execution policy enforcement

The mechanism behind each authorization decision: intercept, evaluate, enforce, all before the action runs.

What is AI Agent Assurance?

The category continuous authorization belongs to: the endpoint control layer for AI agents.

AI agent security policies

Examples of what Certiv's managed policies authorize or block on every agent action, each mapped to a named risk.

OpenAI agent sandbox escape

A real long-horizon agent whose behavior drifted from its original constraint: why intent has to be authorized over the whole session.

OpenAI models breached Hugging Face

The companion disclosure: models bought their way out of an eval sandbox and breached a third party step by step, showing why intent has to hold across the whole trajectory.

For security teams

The six controls to evaluate when rolling out Claude Code and other AI agents.

Is Codex safe to run?

Where Codex risk concentrates: the full-access modes teams actually use, and the inputs attackers control.