翻訳待ち：The Agent Access Model

AI サービスが一時的に利用できないため、復旧後に翻訳を補完します。

For the last twelve years, enterprise security has moved away from trusting the network. BeyondCorp made the case that a request's origin, inside the corporate perimeter or on the open Internet, should not decide whether it is allowed. Identity and device health should. That model won: it now underpins much of Zero Trust. Google’s BeyondCorp assumed a specific principal: a human at a device, acting at human speed. Organizations are now deploying agents, software principals that reason, act, and reach into systems on our behalf. A task-scoped agent run is ephemeral. It ends when its work is done. A long-lived agent service may handle many such tasks and move data far faster than a person. The controls we built for humans do not fail loudly when we point them at agents. They fail quietly, by granting too much, seeing too little, and trusting for too long. This paper proposes an access model for agents: the Agent Access Model (AAM). We describe the model and show how its components can be built. We then walk through a concrete example and separate the single-principal controls available today from the harder problem of multiplayer access control. Much of the current work tries to make each access decision smarter. AAM takes a different approach: make the agent's capability smaller, so there is less to judge in the first place. The shift A decade ago, the hard question in enterprise security was where is this request coming from, and do I trust that place? BeyondCorp's answer was that you should not trust the place at all. You authenticate the user, interrogate the device, and make an access decision for that specific request. Location became one signal among many, not a verdict. That reframing worked because the principal was legible. A human logs in each morning, carries a device or two, works at human speed, and generates a trickle of access decisions a system can reason about. We built an entire industry around that shape of principal: single sign-on, device posture, conditional access, session risk scoring. Agents do not have that shape. An agent service may run many tasks. In this paper, an agent is one task-scoped run. We use task execution graph for all work belonging to that run and governed by the same capability ceiling and trust level. The same harness solving a different task, consuming a different event, or running on tomorrow's schedule creates a new graph. A single human instruction (reconcile these two ledgers, triage the overnight alerts, open a pull request that fixes this bug) can dispatch one or more such tasks. Each may need to reach databases, source control, logs, ticketing systems, knowledge bases, documents, or spreadsheets. The task may need broad access. It needs it now, for this task, and ideally not one second longer. An agent must have enough authority to complete its task and no more. Least privilege is as old as access control. What changes is how quickly and often it must be enforced. For a workforce of humans, least privilege is often a policy reviewed every quarter. For large populations of short-lived agents, it is a system that runs in real time and leaves an audit trail. Why the human model does not transfer Agents look like service accounts or very fast users. Four properties make both sets of controls a poor fit. Agents are ephemeral. Credentials are durable. Service accounts were designed for long-lived software: a payroll system, a nightly batch job. They often come with long-lived keys, broad scopes, and rare rotation. Applied to short-lived agents, those credentials outlive the work they were issued for and remain in memory, logs, or environment variables where they can be replayed. The lifetime of the credential should match the lifetime of the task. For an agent, that is often minutes. Agents act at machine speed. Anomaly detection, rate limits, and data-loss controls tuned for human activity may react too slowly. An agent with a database connection and an outbound network path can read a table and POST it to an external endpoint before a human-tuned control has finished sampling. Preventive controls therefore have to run inline, at the point of action. The prompt is not a perimeter. Teams commonly tell an agent do not access production or never send data to third parties. Those instructions help shape behavior, but they do not enforce access. A model can be manipulated by content injected into the data it reads or can produce an unsafe action on its own. Inferred intent can inform a risk decision, but an attacker can shape that signal through the same text. Enforcement belongs in the harness that mediates tool calls and at the network layer that mediates packets. A boundary you can talk your way past is not a boundary. Agents compose authority across hops. An agent can invoke a tool that invokes another agent, which calls an API on behalf of the original human. Somewhere in that chain, the answer to who is this for, and what are they allowed to do can disappear. Existing primitives handle a single hop of delegation better than they handle many hops or several humans. The Agent Access Model The Agent Access Model starts with one rule: Do not trust the run. Authorize every action against the task and its accumulated state. BeyondCorp removed implicit trust from the network. AAM removes implicit trust from the task execution graph. Authorization for one action does not carry over to the next. Every action is evaluated against three things: who the agent is, what task it was authorized to perform, and which policy-relevant resources the graph has already touched. That accumulated state can only reduce the graph's remaining capabilities. Google's Beyond Zero makes the same opening move: shrink the trust boundary from the application to the individual action and make the decision at machine speed. Beyond Zero puts a reasoning engine behind each authorization decision. AAM bounds the capability set that engine must judge. The two approaches fit together. For actions that cross a declared mediation boundary, AAM records the agent, principal, and task behind each authorization decision. AAM has five principles. 1. Credentials are short-lived and bound. An agent receives a credential minted for the task and expiring with it. Tokens are sender-constrained, so a stolen token alone cannot be replayed without the harness-held proof key. 2. Enforcement lives in the harness and the network, not the prompt. Policy is applied where tool calls and network requests actually happen. The prompt is where you express intent. It is never where you enforce a boundary. 3. Human oversight is exceptional. Approvals are reserved for decisions that warrant them. a person to approve every step creates fatigue and reflexive clicking. 4. Grants are reviewed from evidence. Directly captured activity can show where a task template is too broad or too narrow. The system proposes a change for review, and an approved change applies to future tasks. It never widens the active task. 5. Capability state moves in one direction. When a declared protected event occurs, the Trust Ratchet removes capabilities across the task execution graph according to policy. Authority removed by the Trust Ratchet returns only in a newly authorized task. A reference architecture The architecture has four active controls and two supporting systems. The active controls govern the task. The Agent Activity Log and Grant Review Loop operate on the evidence it leaves behind. AAM defines how these pieces fit together and what each one must guarantee. This is a reference architecture, not a wire-level specification. 4.1 The Agent Identity Broker At dispatch, the Agent Identity Broker issues a short-lived, verifiable credential scoped to the task. That credential expires no later than the task ends. The credential is task-scoped: it encodes "this is agent X, acting for principal H, to do task T." It is also sender-constrained, bound to a proof key held by the harness. A leaked token alone cannot be replayed without that key, and the model never receives it. Existing standards provide both primitives. OAuth 2.0 Token Exchange (RFC 8693) defines an exchange through a Security Token Service and can produce a token narrowed by audience, resource, or scope. The authorization server's policy determines what it issues. The token's act claim identifies the current actor, while nested act claims can retain prior actors for attribution. DPoP (RFC 9449) binds an OAuth token to a client key and requires proof on each protected request. That proof covers the HTTP method and target URI, but not the request body, query parameters, or tool arguments. The harness must therefore authorize an immutable request representation and execute that same request. Neither standard defines AAM's task template, Trust Ratchet state, or cross-layer enforcement. AAuth draft 09 addresses agent-to-resource identity and authorization, including per-instance identity, optional missions, tool permissions, audit, and asynchronous authorization. It could realize part of this model and remains a work in progress. AAM depends on four properties of the credential: it is short-lived, task-scoped, sender-constrained, and attributable. It does not depend on one protocol winning. 4.2 The Task-Scoped Access Engine The credential establishes who the agent is and which task it is performing. The Task-Scoped Access Engine decides, per request, whether this identity may perform this action against this resource. It extends BeyondCorp's Access Control Engine by making the task itself a first-class input to the decision. Its job is to make least privilege both the default and the ceiling. A task grant might read: "agent X, for task T, may read tables A, B, and C for the next ten minutes." That is the envelope. Undeclared actions are denied. Where does the envelope come from? A task's scope is declared when the agent is dispatched, not negotiated by the agent at runtime. In the common case, a human or a system acting on a human's standing authority defines a task template once: "Reconciliation may read these three tables and post to this channel." Each dispatch instantiates it. Templates are the unit of configuration, so the number of policies tracks the number of distinct tasks rather than the number of runs. At dispatch, the Access Engine intersects the approved template with the authority of the initiating principal and agent service, then applies resource-owner and tenant policy. That intersection is the task's capability ceiling. The agent can ask for less, and the Trust Ratchet can remove capabilities. Broader authority requires a newly authorized task. For each action, the adapter constructs and freezes the complete request representation, including the operation, resource, arguments that affect scope, tenant, and recipient. The Access Engine authorizes that representation against the current capability ceiling, and the adapter executes the same representation. Credential renewal revalidates the original ceiling and current Trust Ratchet state. It cannot restore a removed capability or extend the maximum task lifetime. 4.3 The Mediation Layer (harness and network) The Mediation Layer governs two boundaries: the tool paths exposed by the harness and outbound traffic forced through the deployment's network boundary. The first is the harness, the runtime that brokers the agent's tool calls. It intercepts calls through declared tool paths, checks them against task policy, and emits enforcement events, subject to the collection gaps described in Section 4.6. The harness can distinguish a read from an update and constrain the arguments that affect scope. MCP standardizes requests over defined transports and supplies an OAuth resource-server boundary for HTTP transports. Its authorization layer does not define AAM's per-tool or argument policy. The harness or tool server must [truncated for AI cost control]