The authorization gap: why an agent's diagnosis should not be its permission slip

A design writeup on dev.to argues that the hardest problem in AI-driven operations is not getting an agent to diagnose an incident, since current models can correlate logs, metrics, deployment events, traces, Kubernetes state and historical incidents well enough to produce plausible remediation proposals ^[1]. The unresolved question, according to the piece, begins one step later: who decides whether the proposed action is allowed to touch production ^[2].

The argument turns on two properties that get conflated. Reasoning quality and operational authority are different things ^[3]. An agent can be highly accurate and still eventually make a bad decision, and if that decision carries unrestricted production authority then model accuracy is a weak safety boundary ^[4]. The proposed architecture therefore assumes recommendations can be wrong and constrains what happens when they are ^[5].

The concrete part starts by refusing natural language. An instruction like "Fix the payments service" contains almost nothing meaningful to authorize ^[6]. Instead the agent emits a typed proposal: a RollbackDeployment action against a named cluster, namespace and workload, an observed revision of 42, a target revision of 41, a reason code, and execution bounds of a 180 second timeout with maxUnavailable set to 1 ^[7]. That document describes intent, not truth ^[8]. The model may propose 41 as the rollback target; it is not trusted to assert that 41 is healthy, that no incompatible database migration occurred, or that 42 is still running when execution begins ^[9]. Those facts come from a deterministic evidence collector that returns deployment generation, current revision, previous revision health, whether a stateful migration was detected, whether a maintenance freeze is active, and an evidence timestamp ^[10].

That separation is the load-bearing part. An agent that supplies both the request and the evidence used to authorize the request can effectively authorize itself, which reduces policy enforcement to security theater ^[11].

Authorization moves outside the agent into Amazon Verified Permissions, which externalizes decisions into Cedar policies; the application asks whether a principal may perform an action against a resource in a context and receives a decision ^[12]. The example rollback permit requires previousRevisionHealthy true, statefulMigrationDetected false, maintenanceFreeze false, and evidence no more than 30 seconds old ^[13]. Absent from it is any model confidence threshold, which the author treats as useful for deciding whether more investigation is needed but a poor substitute for operational invariants ^[14]. The signals the control plane is told to ask about instead are dull and checkable: is the target revision known and healthy, has persistent state changed, is the request still current, is this namespace eligible for autonomous remediation, does the executor have authority here, is a change freeze active ^[15]. Cedar's default-deny model, where a matching forbid overrides any permit and a request with no applicable permit is denied, supports categorical exclusions such as forbidding anything that is both production and modifies persistent data ^[16][17].

One ratio is worth holding onto. The example policy accepts evidence up to 30 seconds old while the same proposal grants itself a 180 second execution window, six times longer ^[18]. The published flow routes both the automatic and the human-decision paths through a revalidation step before the bounded runbook, the EKS executor and an independent verification stage ^[19], which is the only thing between a stale authorization and a mid-flight cluster change.

The text stops before the runbook mechanics, though the title names Step Functions and Systems Manager as the bounded execution layer ^[20]. Watch that half: what permissions the evidence collector holds relative to the agent, whether revalidation re-collects evidence or replays it, and whether the executor's own authority is narrower than the policy evaluating it.