Permission isn't purpose: Intent-based authorization in Omnigent

Summary

Omnigent’s intent-based authorization addresses a gap in identity-based access control: an agent with valid credentials may follow indirect prompt injections embedded in data and perform authorized actions unrelated to the user’s task. It binds each session to a human-declared purpose and evaluates that intent before every tool call, producing permitted, consent-required, or denied verdicts. In a data-quality example, reading a customers table is allowed, dashboard publication requires approval, and an injected request to grant external access is denied despite the agent’s identity permitting that tool. The intent is fixed at design time for autonomous agents or approved by a human at session start for interactive agents, and cannot be broadened by the agent. Omnigent combines this policy with session-risk scoring and other contextual policies in a single engine where any denial wins.

Context

Agents operate with valid credentials and may encounter indirect prompt injections in documents, web pages, emails, tickets, or user-supplied table data. Identity-based authorization determines whether an agent may perform an action, but does not determine whether that action fits the current task, allowing an injected instruction to trigger an authorized but unrequested operation.

Approach / What changed

A contextual policy binds each session to a declared purpose and evaluates it before every tool call. Actions receive permitted, consent-required, or denied verdicts; intents are fixed for autonomous agents or drafted and approved by a human for interactive sessions. Policies cannot be removed or weakened by the agent, and any denial wins when policies combine.

Takeaways

• Intent-based authorization narrows an agent’s identity-based permissions to actions that fit the session’s declared purpose.
• In the data-quality example, query_table is allowed, update_dashboard requires human approval, and an injected grant_table_access request is denied.
• Agents cannot broaden their own intent: they lack tools to remove or edit policies, new policies require human approval, and permissive policies cannot override a denial.

Related reading