Blog / BABYLON-60
Authorization must survive incorrect reasoning
How to separate an agent’s proposal from the decision that permits an effect on a protected resource.
An explanation does not grant permission
An agent can explain why it wants to delete a file while being wrong about the file, the user or the scope. The quality of its explanation does not change the process permissions. OWASP identifies excessive functionality, permissions and autonomy as causes of excessive agency. Execution needs an independent check of structured facts: who is requesting, which operation is proposed, which resource it concerns and which conditions must hold.
Authorize the specific operation
Consider a request to modify a report. Approving a generic description leaves room to change the destination or the bytes later. A useful contract binds authorization to the effect type, resource identity, applicable policy and preconditions. The broker checks those facts again when executing. If a required field is missing, permission has expired or the resource has changed, it must reject the request rather than infer the missing authorization from the surrounding conversation.
Close alternative paths
This separation controls only operations that pass through the broker. If the agent retains direct access to the same directory, it can bypass that route. The process confinement and the final observed effect therefore need checking as well as the approval receipt. BABYLON’s repository describes this boundary in user space. Likewise, a valid software signature does not by itself establish that Touch ID was used or that hardware verified a human presence.