🤖 AI

Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI

This paper proposes a compositional governance framework that introduces formal primitives for recursive delegation, contextual boundaries, and dynamic scoping to overcome the limitations of traditional authorization systems in managing the complex, autonomous nature of agentic AI.

Original authors: Amjad Ibrahim, Yong Li

Published 2026-06-03✓ Author reviewed ⓘ

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Amjad Ibrahim, Yong Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: From "Keys" to "Smart Contracts"

Imagine you have a house (your digital life) and you hire a human assistant to clean it. You give them a key. That key works forever, or until you take it back. This is how traditional computer security works: you give a user a "token" or a "key" that says, "You can open the front door."

Now, imagine you hire a robot assistant (an AI Agent) that is super smart. It doesn't just clean; it can hire other robots to help, it can decide to open the fridge, the garage, or the safe, and it can do this while you are asleep.

The Problem:
The old "key" system breaks here.

Too much power: If you give the robot the master key, it might accidentally open the safe and delete your photos.
Too rigid: If the robot needs to hire a sub-robot to fix the plumbing, the old system doesn't know how to pass the "plumbing permission" down the chain.
Static: The old key doesn't know when or where it's being used. It just opens the door.

The Solution:
This paper proposes a new way to manage these AI robots. Instead of giving them a static key, we give them a dynamic, living contract. Think of it like a smart wristband that changes its rules based on the situation.

The Core Concepts (The "How-To")

The authors suggest three main ingredients to make this work:

1. Delegation as a "Contract" (Not just a Key)

In the old world, delegation was like handing someone a spare key. In this new world, delegation is like signing a temporary, specific contract.

Analogy: Imagine you hire a contractor to fix your roof. You don't give them the keys to your entire house. You give them a contract that says: "You can enter the roof area, but only between 9 AM and 5 PM, and only if you are wearing a safety harness."
In the paper: This is called Delegation. It's a rule that says, "Agent A can act for User B, but only under these specific conditions."

2. Scope as an "Envelope" (The Bubble)

You can't let the robot wander everywhere. You need to put it inside a bubble.

Analogy: Imagine the robot is inside a holographic bubble. Inside the bubble, it can touch things. Outside the bubble, it can't. If the robot tries to reach out of the bubble, the system says, "No, you're out of bounds."
In the paper: This is called Scope. It limits what the agent can touch. If a user delegates permission to "edit documents," the agent's bubble only covers documents, not "delete budgets."

3. The "Overlay" (The Magic Layer)

The hardest part is that companies already have security systems (like the ones used for human employees). They don't want to throw them away and start over.

Analogy: Imagine your house has a very old, sturdy alarm system. You don't want to rip the walls out to install the new robot security. Instead, you overlay a new, transparent smart-glass layer on top of the old system. The old alarm still works for humans, but the new glass layer adds the "robot rules" on top of it.
In the paper: This is the Compositional Operator. It takes the existing security rules and "glues" the new agent rules onto them without breaking the old ones. It creates a new "graph" (a map of who can do what) that combines both.

How It Works in Real Life (The Scenario)

Let's look at a story from the paper to see how this "Overlay" works:

The User: Bob is a human employee. He has permission to view a folder of design documents.
The Delegation: Bob asks his AI assistant, "Agent 1," to read those documents for him.
- The Contract: Bob signs a digital contract with Agent 1. "You can read these docs, but only for the next hour."
The Sub-Delegation: Agent 1 realizes it's too busy, so it asks a second robot, "Agent 2," to help.
- The Chain: Agent 1 passes a smaller contract to Agent 2. "You can read the docs, but only for the next 10 minutes, and only the 'Budget' file."
The Check: Agent 2 tries to open the file.
- Step A (The Bubble): The system checks: Is Agent 2 inside the "Design Folder" bubble? Yes.
- Step B (The Chain): The system checks: Did Agent 2 get permission from someone who actually has the key? Yes, it traces back to Bob.
- Step C (The Conditions): The system checks: Is it still within the 10-minute window? Yes.
- Result: The door opens.

If Agent 2 tries to open a file outside the folder, or if the 10 minutes are up, the "contract" says "No," and the door stays shut.

Why This Matters (The "So What?")

The paper argues that we need this system because AI agents are becoming autonomous. They aren't just tools; they are actors that can make decisions, hire other agents, and move around.

Safety: It prevents an AI from going rogue and doing things it wasn't supposed to (like deleting your bank account because it was "helping" you organize finances).
Accountability: If something goes wrong, you can look at the "contract chain" and see exactly who gave permission to whom, and under what conditions. It's like a paper trail for digital actions.
Flexibility: It allows companies to use their existing security systems (which they've spent years building) without having to rebuild everything from scratch. They just "overlay" the new AI rules on top.

Summary

The paper proposes a new framework where AI agents don't get static "keys" to your digital house. Instead, they get dynamic, time-limited, context-aware contracts that are layered on top of your existing security. This ensures that even as AI agents get smarter and more independent, they remain within the boundaries you set, acting as responsible delegates rather than uncontrollable forces.

Technical Summary: Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI

1. Problem Statement

As AI systems evolve from passive models into autonomous "Agentic AI" capable of initiating actions, collaborating, and recursively delegating tasks, traditional software boundaries and authorization frameworks become insufficient. Existing Identity and Access Management (IAM) systems and standards like OAuth 2.0 rely on static tokens, fixed scopes, and explicit requests. These mechanisms fail to capture the dynamic, recursive nature of agent interactions where:

Recursive Delegation: Agents delegate sub-tasks to other agents, creating chains of authority that static tokens cannot efficiently represent.
Dynamic Context: Agents operate under runtime conditions (e.g., time limits, specific hardware, network locations) that static scopes cannot adapt to.
Scope Attenuation: There is a lack of mechanisms to progressively narrow the scope of authority as it passes down a delegation chain (e.g., an agent can edit proposals but not budgets).
Accountability: Traditional models struggle to trace the lineage of permissions in complex, multi-agent ecosystems, making forensic analysis and least-privilege enforcement difficult.

The paper argues that treating delegation merely as a credential transfer is inadequate; instead, it must be treated as a contractual term with executable governance primitives.

2. Methodology

The authors propose a compositional governance framework that overlays agentic semantics onto existing authorization domains without rewriting their core logic. The methodology is grounded in Relation-Based Access Control (ReBAC) and utilizes OpenFGA (an open-source implementation of Google's Zanzibar model) as the reference substrate.

Core Components:

Relational Primitives: The framework defines delegation and scope as relational graph edges rather than static tokens.
- Delegation Types: The paper formalizes six types of delegation:
  1. Full delegation: Unconditional "speaks-for" authority.
  2. Scoped delegation: Authority limited to a subset of actions/resources.
  3. Conditional delegation: Authority valid only under specific predicates (e.g., time, location).
  4. Depth-bounded delegation: Limits the recursion depth of delegation chains.
  5. Temporal delegation: Time-bound validity.
  6. Group delegation: Requires multi-principal approval (n-of-m).
- Scope and Attenuation: Scopes are modeled as hierarchical containers (e.g., organization $\to$ project $\to$ folder). An agent's "authorization envelope" is the intersection of its delegation chain (originating from a human) and its active session scope.
Compositional Operator (Overlay):
- The authors define a typed graph rewrite operator (inspired by Double-Pushout/DPO theory) that fuses a domain-specific ReBAC schema with a generic "agentic overlay" schema.
- The overlay introduces new types (agent, session, scope) and relations (delegatee, can_execute_on_my_behalf, in_scope).
- Lift Specification: The operator "lifts" existing human permissions (e.g., viewer) and redefines them as the union of the original human access and the intersection of:
  1. Agents in the active scope (ags_in_scope).
  2. Agents reachable via a delegation chain from the original human principals (chain_agents_for_r).
- This ensures that human access remains authoritative, while agent access is strictly derived and bounded by the overlay.

3. Key Contributions

The paper makes four specific contributions:

Conceptualization: It defines delegation types and resource scoping as the primary drivers of agentic access, moving beyond static roles to contractual, runtime-evaluated terms.
Formalization: It provides a formalization of delegation as an agentic governance overlay and a compositional operator to integrate these semantics into existing authorization domains, drawing on graph transformation theory.
Security Architecture: It illustrates a security architecture that utilizes the resulting authorization graph to govern users, agents, scopes, and delegation sessions, enabling continuous verification and revocation.
Validation: It includes formal proofs for the preservation of existing authorization semantics and agent-authorization soundness, alongside empirical benchmarks demonstrating the runtime overhead of the overlay on large synthetic ReBAC models.

4. Results and Evaluation

Formal Proofs: The authors prove that the compositional overlay preserves the soundness of the underlying ReBAC engine. The overlay does not introduce new execution semantics for authorization checks but rather adds well-typed relations evaluated by the existing userset machinery. This ensures that the system remains deterministic and well-founded.
Empirical Evaluation: The paper presents benchmarks showing the runtime overhead of applying the overlay to large synthetic ReBAC models. The results indicate that the compositional approach is practical and introduces manageable overhead, supporting its feasibility for real-world deployment.
Operational Example: The framework is demonstrated through a scenario where a user delegates authority to an agent with time-limited constraints. The system successfully computes the agent's access rights by intersecting the delegation chain with the active session scope, revoking access immediately upon condition expiration.

5. Significance and Claims

The paper claims to provide a formal yet practical foundation for accountable authorization in agentic AI systems. Its significance lies in:

Operationalizing Governance: It moves AI governance from abstract principles to executable, relational primitives that can be standardized and reused across different domains (e.g., finance, healthcare).
Least Privilege Enforcement: By treating delegation as a contractual, context-aware relation, the framework enforces least privilege dynamically, ensuring agents only act within their bounded "envelopes."
Interoperability: The compositional nature of the framework allows it to sit on top of existing RBAC, ABAC, or hybrid policies without requiring a complete redesign of enterprise identity infrastructures.
Traceability: It enables the tracing of authorization states, allowing systems to audit the chain of delegation and scope for any given action, which is critical for forensic analysis in autonomous systems.

The authors position this work as a necessary evolution from static token-based consent (OAuth) to dynamic, recursive, and context-aware governance primitives required for the next generation of autonomous agents.