Category 3 of 12 · Controls: What the agent may do

Agent authorization and fine-grained policy

Policy engines that decide, per tool call and per resource, whether an agent may act, including relationship-based and policy-based models and continuous re-evaluation instead of standing grants.

Mitigates: ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, LLM06 Excessive Agency

Vendors, by signal score

• #1
  VezaAcquired by ServiceNow

  Identity security platform built on a permissions graph; its AI Agent Security product discovers agents and MCP servers, assigns human owners, and shows what data each agent can reach. Acquired by ServiceNow in 2026.

  50
• #2
  SGNLAcquired by CrowdStrike

  Continuous identity platform that evaluates policy in real time to grant or revoke access, including an MCP gateway that decides which tools an agent may call on a user's behalf. Acquired by CrowdStrike in 2026.

  22

Ranked within this category only. How the score works.

Also covers this category

• Auth0

  Auth0 for AI Agents, part of Okta: user login for agents, Token Vault for third-party API tokens, asynchronous approval over CIBA, fine-grained authorization for RAG, and authorization for MCP servers.

  65
• CrowdStrikePlatform suite

  Falcon AIDR, now presented as Falcon Guardian, discovers workforce AI and endpoint agents, governs which agents may run, and ties each prompt, identity, and tool call to downstream system actions in Falcon Next-Gen SIEM. Built with the Pangea acquisition, with SGNL powering Continuous Identity for AI Agents.

  67
• Oasis SecurityAcquired by Cyera

  Non-human identity management and Agentic Access Management: provisions ephemeral, per-session identities for agents and records prompt, intent, policy, and action for each session. Acquired by Cyera, now sold as Cyera Identity.

  43
• SailPointPlatform suite

  SailPoint Agentic Fabric inventories AI agents and machine identities, ties each agent to a human owner through its lifecycle, applies real-time authorization, and disables rogue agents and revokes their credentials. The Entro Security acquisition extends it to non-human identity discovery.

  74

Questions to ask a vendor

1. Can policy be expressed per tool and per resource, not only per app?
2. Is authorization re-evaluated during a session, or granted once at login?
3. Can retrieval be filtered to the requesting user's permissions?

Go deeper

• Authorization patterns for agentic workflows
• Authorization tools shortlist

FAQ

Why is authentication not enough for agents?

Knowing which agent is calling does not tell you whether this call, on this record, for this user, should be allowed. Agents chain many calls quickly, so the decision has to happen per action.

What is permission-aware retrieval?

A retrieval step that filters documents by what the person behind the agent is allowed to read before anything reaches the model, so the agent cannot summarise data its user could not open.