Your AI Agents Are Overprivileged: The Case for Fine-Grained Authorization
summary
Claim: agents frequently get broad tokens and leak confidential data; fix is relationship-based Fine-Grained Authorization enforced at query time. Demo uses OpenFGA with a Chroma vector DB and pre-filtering (not post-filtering) to drop unauthorized RAG chunks before generation, plus an expense-approval agent that refuses actions without the right relation. System leverages Zanzibar-style scale (billions of checks), centralizes policies, and the demos show policy enforcement working end-to-end.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 2:44The evolution of AI agents
- 8:16Security risks in AI workflows
- 11:59Four pillars of secure AI
- 17:07Authorization vs. authentication
- 23:12Evolution of access control
- 29:30Introducing OpenFGA
- 37:01AI assistant implementation demo
- 47:10Tools and final summary
related talks
30mYour AI Agents Are Overprivileged: The Case for Fine-Grained Authorization
57mFine-Grained Authorization: The Missing Piece in Agentic AI Security
30mFine-Grained Authorization: The Missing Piece in Agentic AI Security
33mHow to Prevent AI Agents from Accessing Unauthorized Data
54mFine-Grained Authorization for Modern Applications
26mBeyond the Gateway: Fine-Grained Authorization for AI Agents
29mHow Auth0 Secures AI Authentication & Authorization for AI Agents
30mYour AI Has Too Much Access: Authorization for Coding Agents