← Full glossary
Runtime authorization
seguridadruntime authz
Runtime authorization is the check, at the exact moment an AI agent requests an action, of whether that specific action is allowed, rather than relying only on permissions granted in advance.
Implementa's formulation. A traditional permission is granted and reviewed periodically; an agent acts at machine speed and can drift outside its remit between reviews. Runtime authorization evaluates each action against policy (who the agent is, what it has been delegated, the context) and allows, denies or escalates it to a person. Several identity-governance vendors added it in 2026, but scope varies: it is not always clear whether it stops an action before it runs or only detects it afterwards.
How it differs from
- Role-based access control (RBAC)
- RBAC grants permissions by role and is reviewed periodically; runtime authorization decides on every request.
- Access certification
- Certification is a periodic after-the-fact review; runtime authorization acts at the moment of the action.
Examples
- A procurement agent asks to approve a payment: policy checks the amount and supplier at that instant and escalates to a person above a threshold.
- An agent tries to read a database outside its scope and the request is denied even though its technical credential would allow it.
FAQ
- Does it replace periodic access reviews?
- No. They complement each other: periodic reviews tidy permissions, while runtime authorization controls each individual action.
- Does it always block the action before it happens?
- It depends on the implementation. Ask for a demo showing it blocks before execution rather than only alerting afterwards.
Related terms
Sources & further reading
- KuppingerCole, Omada gains runtime agent governance · 2026-09-25
- Futurum, SailPoint Navigate 2026 · 2026-10-09