How do you defend against principals (e.g. AI agents) using their access grants, which all look fine when considered individually, for something they weren't supposed to? For example, the ability to read private data and write data to the internet might be fine in isolation, but when combined, allows for data exfiltration.

It all starts from being able to express privileges in various systems in one unified and analyzable language. The CNCF project Cedar Policy offers a unified language and engine for attribute-, relation- and role-based access control policies, along with unique policy querying and analysis features, perfect for use in agentic systems.

By compiling the semantics of various systems' access control policies into one format, one can statically analyze how agents e.g. could collude with each other to extend their permissions or acquire privileges in a target system through an intermediate one.

This brings us to a form of "calculus for permissions", which allows us not to only reason about explicit permissions, but also implicit ones. This means one can prove, not just unit-test, invariants (under the given assumptions) of the defined permissions themselves, such as "AI agents must never be able to exfiltrate data", and ask "is there any AI agent that can reach this secret resource?"