Executive Summary

Artificial Intelligence is rapidly becoming a new execution layer for the enterprise. Organizations are moving beyond experimentation with generative AI and deploying autonomous agents, AI copilots, multi-agent workflows, and intelligent automation systems across business and technology operations. These systems increasingly possess the ability to reason, plan, invoke tools, access enterprise resources, and execute actions with limited human oversight.

While this transformation promises substantial gains in productivity and operational efficiency, it simultaneously creates an entirely new category of security and governance challenges. Traditional authorization models were designed for a world in which users interacted directly with applications and applications executed deterministic workflows. Agentic systems fundamentally alter these assumptions. A single user request can trigger dozens or hundreds of actions across multiple agents, tools, APIs, and business systems before a final outcome is produced.

As organizations embrace autonomous systems, authorization can no longer be treated as a point-in-time decision based solely on identity. The central challenge becomes ensuring that actions remain aligned with the intent originally authorized by the user and that behavior remains consistent with expected operational patterns throughout execution.

This paper introduces Intent and Behavior Based Access Control (IBAC), a new authorization paradigm designed for agentic AI environments. IBAC extends modern runtime authorization by continuously evaluating intent alignment, behavioral consistency, and identity continuity at every hop of an AI-driven workflow while enforcing deterministic policy boundaries that remain auditable and non-negotiable.

We argue that IBAC represents the next evolution of enterprise authorization and will become a foundational control for organizations implementing AI governance frameworks such as the NIST AI Risk Management Framework, Gartner's AI Trust, Risk, and Security Management (AI TRiSM) and emerging agentic AI security architectures.

1. The Emergence of the Agentic Enterprise

The enterprise adoption of artificial intelligence has accelerated at an unprecedented pace. Organizations are deploying AI across virtually every business function, including customer service, software engineering, financial operations, human resources, supply chain management, and cybersecurity operations.

The first wave of enterprise AI adoption focused primarily on information retrieval and content generation. Employees leveraged Large Language Models (LLMs) to summarize documents, generate code, draft communications, and improve productivity. While valuable, these systems largely remained passive participants in enterprise workflows.

The current wave of adoption is fundamentally different. Modern AI systems increasingly act rather than merely respond. AI agents can create plans, decompose objectives into subtasks, invoke tools, access enterprise applications, interact with databases, execute transactions, and coordinate with other agents. Rather than supporting business processes, these systems are beginning to participate directly in them.

This shift effectively transforms AI into a new execution layer for the enterprise. The business benefits are substantial. Organizations can automate increasingly complex tasks, reduce operational costs, improve responsiveness, and accelerate innovation. At the same time, autonomous execution significantly expands the enterprise attack surface. Every model, prompt, orchestration framework, memory system, tool connector, API, and downstream application becomes part of the operational security boundary.

This challenge is reflected in Gartner's AI TRiSM framework, which recognizes that AI governance must extend beyond model evaluation and encompass runtime trust, risk, security, and compliance controls. AI TRiSM emphasizes continuous governance of the entire AI ecosystem, including models, prompts, agents, data sources, tools, and downstream actions.

The fundamental problem is that autonomous systems increasingly operate within environments that were never designed for autonomous decision making. Existing authorization models were built for deterministic software. Agentic AI introduces dynamic workflows, autonomous delegation, and continuously evolving execution paths that require a fundamentally different approach to access control.

2. Why Traditional Authorization Models Break Down

For decades, enterprise authorization has focused on determining whether a particular identity should be allowed to perform a specific action against a protected resource.

Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Relationship-Based Access Control (ReBAC), and Policy-Based Access Control (PBAC) all represent important advances in authorization architecture. Modern policy engines such as Cedar, OPA, and Zanzibar-inspired systems have enabled organizations to centralize authorization decisions and implement fine-grained runtime controls.

Despite these advances, traditional authorization models rely on assumptions that become increasingly fragile in agentic environments.

The first assumption is that the principal performing an action remains stable throughout the transaction. The second assumption is that workflows are predictable and largely deterministic. The third assumption is that evaluating authorization at a specific point in time provides a reasonable approximation of whether the resulting action should occur.

Agentic systems violate all three assumptions. A user requesting a customer analysis may unknowingly trigger interactions across CRM systems, contract repositories, support ticketing platforms, financial systems, and external data sources. Multiple agents may participate in the workflow, each acting under its own identity and permissions. New actions emerge dynamically as the workflow evolves.

Every individual action may satisfy existing authorization policies. But, the overall outcome may still be inappropriate.

This challenge becomes particularly visible through the classic confused deputy problem. In traditional systems, a confused deputy is a privileged intermediary manipulated into exercising authority on behalf of another party. Agentic AI effectively industrializes this pattern. Agents often require broad permissions to perform useful work and continuously reinterpret instructions based on newly acquired information. The result is a highly privileged intermediary capable of executing actions that remain technically authorized but operationally inappropriate.

The authorization problem therefore shifts from evaluating individual requests to evaluating the trajectory of an entire workflow.

3. The Two Decays: Identity Decay and Intent Decay

The fundamental authorization challenge of agentic systems can be understood through two interconnected processes: Identity Decay and Intent Decay. Together, these represent the primary mechanisms through which trust degrades across autonomous workflows.

Identity Decay occurs when the relationship between an executed action and the human authority that originally authorized it becomes progressively weaker through delegation. A human delegates work to an orchestrator. The orchestrator delegates work to a specialized agent. The specialized agent invokes tools using service identities. Each handoff introduces additional separation between the action and its originating authority.

Eventually, authorization systems observe only a workload identity or service account performing an operation. The original user, their permissions, and the context under which authority was granted become increasingly opaque.

Intent Decay follows a parallel path. Every hop in an agentic workflow involves interpretation. User objectives become plans. Plans become subtasks. Tool outputs become new inputs. Retrieved documents influence reasoning. Memory systems provide context. Each step may be individually reasonable while collectively moving the workflow further away from the objective originally authorized. Intent rarely fails catastrophically. Instead, it drifts gradually.

The two Decays are not an alternative taxonomy to established threat frameworks — they are the underlying processes those frameworks describe. Table 1 maps the most relevant OWASP Agentic Security Initiative risks onto the decay at work and the point where deterministic IBAC intervenes.

Table 1 — How the Two Decays map onto the OWASP Agentic Security Initiative Top 10, and where deterministic IBAC intervenes.

This drift may result from benign workflow evolution, adversarial manipulation, prompt injection, poisoned context, incorrect assumptions, or unexpected interactions between agents and tools. Regardless of the cause, the challenge remains the same: ensuring that actions continue to serve the intent originally authorized by the user.

The Two Decays create a fundamentally different security challenge than those addressed by traditional authorization systems. Identity and intent are no longer static attributes. Both evolve continuously throughout execution.

4. Why Existing Approaches Fall Short

The market has largely responded to agentic security challenges through two independent approaches.

The first approach extends traditional authorization through increasingly fine-grained policy enforcement. PBAC platforms externalize authorization logic and evaluate policies dynamically at runtime. These systems provide determinism, auditability, and governance.

However, policies remain fundamentally tied to identities and actions. They answer whether an action is permitted. They do not evaluate whether the action remains aligned with the purpose that originally justified it. As Intent Decay increases, policy engines become increasingly blind to workflow trajectory.

The second approach focuses on intent evaluation. Emerging AI security platforms use machine learning and large language models to evaluate user intent and identify potentially risky actions. These systems provide valuable signals. However, they remain probabilistic.

A model may conclude that an action appears suspicious or aligned with intent, but enterprises cannot rely exclusively on probabilistic systems to make authorization decisions. Models can misclassify context, produce inconsistent outcomes, and be manipulated by adversarial inputs.

The challenge is not that either approach is wrong. The challenge is that each solves only part of the problem.

Policies provide deterministic enforcement but lack understanding of intent. Intent evaluation provides contextual understanding but lacks deterministic guarantees. Agentic environments require both.

5. Introducing Deterministic IBAC

IBAC extends authorization beyond identity, resource, and action by introducing two additional dimensions: intent and behavior.

Rather than asking only whether an identity possesses permission to perform an action, IBAC evaluates whether the action remains aligned with the originally authorized objective and whether observed behavior remains consistent with expected patterns.

Deterministic IBAC combines probabilistic evaluation with deterministic enforcement. At every hop, three questions are evaluated:

• Is this action still aligned with the intent originally authorized?
• Is the observed behavior consistent with historical patterns for this entity?
• Can the action be traced back to the originating identity through an unbroken chain of delegation?

The answers to these questions are necessarily probabilistic. What makes IBAC deterministic is the policy boundary within which those evaluations operate.

Business defined policies establish non-negotiable constraints. Intent may evolve within these boundaries. It cannot cross them.

6. The Technical Architecture Behind Deterministic IBAC

Implementing IBAC requires a new authorization architecture designed specifically for agentic systems.

The first component is identity continuity. Human users, agents, workloads, services, and tools must possess verifiable identities that persist throughout execution. Emerging standards such as SPIFFE workload identities and transaction-token architectures provide the foundation for establishing chain-of-custody across delegation boundaries.

The second component is continuous intent evaluation. Rather than evaluating authorization exclusively at session establishment or credential issuance, intent must be reassessed at every execution hop. This evaluation combines semantic similarity analysis, contextual reasoning, workflow state, and execution history to determine whether actions remain aligned with authorized objectives.

The third component is behavioral analysis. Human and non-human identities establish behavioral baselines over time. Deviations from expected operating patterns become risk signals that influence authorization decisions.

Modern implementations increasingly leverage LLM-as-Judge architectures to evaluate intent alignment, behavioral consistency, and contextual risk. Enterprises may choose to utilize Reva-provided Small Language Models (SLMs), enriched through enterprise-specific retrieval, organizational context, and domain knowledge, to perform these evaluations while maintaining control over sensitive data and decision-making processes.

Reva's patent-pending implementation of deterministic IBAC combines these probabilistic evaluations with deterministic policy enforcement, ensuring that critical business controls remain auditable, explainable, and non-negotiable. Every authorization decision generates a comprehensive decision snapshot that captures identity chain-of-custody, intent evaluation, behavioral assessment, policy reasoning, risk signals, and enforcement outcomes. This creates an enterprise-grade audit trail designed to support accountability, transparency, and continuous governance requirements across frameworks such as the EU AI Act, NIST AI RMF, ISO/IEC 42001, and other emerging AI governance and operational resilience regulations.

To support real-time operations, authorization decisions must execute within interactive latency budgets. Reva's architecture is optimized for inline authorization, achieving p90 decision latency below 40 milliseconds for standard evaluation paths while supporting progressive evaluation for more complex workflows. Internal testing demonstrates 98% accuracy in behavioral drift detection using self-learning models and LLM-as-Judge validation while supporting billions of authorization decisions across human and non-human identities.

7. Operationalizing AI TRiSM Through IBAC

Gartner's AI TRiSM framework emphasizes the need for runtime controls capable of governing trust, risk, security, and compliance across AI ecosystems.

IBAC provides a practical mechanism for operationalizing these principles. Trust is established through continuous validation of intent alignment and identity continuity. Risk is managed through behavioral analysis, drift detection, and contextual evaluation. Security is enforced through deterministic policies that constrain autonomous behavior. Compliance is supported through audit trails that connect every action to an originating authority and authorized objective.

Most AI governance frameworks focus heavily on pre-deployment controls such as model validation, testing, and certification. While necessary, these controls become increasingly insufficient as autonomous systems dynamically adapt during execution.

IBAC extends governance into runtime. Rather than evaluating whether a model is trustworthy, IBAC continuously evaluates whether a workflow remains trustworthy while it executes.

This shift mirrors broader industry trends toward adaptive authorization, continuous verification, and runtime security controls.

8. Industry Applications of IBAC

The value of IBAC becomes particularly apparent in industries where actions carry significant financial, operational, or regulatory consequences.

In financial services, IBAC can prevent transaction drift, fraudulent payment routing, unauthorized entitlement changes, and inappropriate expansion of financial workflows. By continuously validating intent and authority, organizations can ensure that autonomous systems remain aligned with approved business objectives that do not violate rigorous segregation of duty controls.

In healthcare, IBAC helps maintain patient privacy boundaries throughout complex clinical workflows. Actions remain continuously tied to authorized treatment purposes, reducing the risk of inappropriate PHI exposure across downstream systems.

Software engineering organizations increasingly rely on coding agents and autonomous infrastructure tools. IBAC enables organizations to constrain production changes, detect privilege escalation attempts, and ensure that deployment activities remain aligned with authorized objectives.

Across all industries, the common challenge is not determining whether an action is technically possible. The challenge is ensuring that the action remains aligned with the objective that originally justified it.

9. The Future of Authorization in the Agentic Enterprise

Authorization has evolved continuously alongside computing itself. The industry moved from access control lists to role-based access control, from roles to attributes, from attributes to policy-driven authorization, and from static authorization toward runtime decisioning.

Agentic AI introduces the next major inflection point. Autonomous systems fundamentally challenge the assumption that identity alone is sufficient to govern access. In environments where workflows continuously reason, adapt, and delegate authority, organizations must evaluate not only who is acting but also why the action is occurring and whether behavior remains aligned with expected outcomes.

Organizations that successfully adopt agentic AI at scale will require controls capable of governing autonomous execution without sacrificing innovation. Deterministic Intent and Behavior Based Access Control provides a framework for achieving this balance.

The next generation of authorization systems will not simply ask:

"Who are you?"

They will ask:

"Who authorized this action, what objective does it serve, does the behavior remain consistent with that objective, and should it still be allowed to proceed?"

That shift - from identity-centric authorization to intent-aware, behavior-aware, deterministic runtime authorization will define the security architecture of the agentic enterprise.