Unverified50% confidenceFactExact time
The delegated authorization mechanism has two mutually independent controls: whether the issuer has the right to delegate that action, and whether the runtime's proposed operation conforms to the policy and the scope of the delegation.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedTool authorization and action authorization are two different levels of authorization: tool authorization answers whether an Agent can use a certain integration, and action authorization answers what it can specifically do and to whom.77% similarUnverifiedAuthorization rules should be enforced at externalized policy enforcement points (such as tool gateways) rather than embedded inside Agents, because Agents themselves are non-deterministic executors.73% similarUnverified每个Agent在执行前需要向协调层注册自己的意图（要操作哪些资源、预计耗时），协调层据此分配锁。71% similarUnverifiedResponsibilities should be separated between the Agent (responsible for proposing, with no sending or credential modification) and the Executor (responsible for acting, only running proposals marked as approved and atomically checking status).70% similarUnverifiedThe runtime cannot authorize itself; before execution, the integrating application establishes a delegation bound to a specific execution, runtime identity, action, resource, and expiration time, and the authorization service validates and persists that delegation.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1066781API
curl https://kongchang.com/api/v1/knowledge/claims/1066781MCP
get_claim(id=1066781)