Brief

This article argues that JSON Web Tokens (JWTs), while useful for authentication, are insufficient for robust authorization in modern applications. The core issue is that JWTs provide static claims about a user's identity and roles at the time of issuance, but fail to account for dynamic factors like resource state, organizational policies, or real-time context. This limitation becomes particularly problematic in microservices architectures, where complex, context-dependent authorization rules are common and difficult to manage when distributed across multiple services. AI

A new paper introduces the concept of 'authorization propagation' as a critical security challenge in multi-agent AI systems. The authors argue that maintaining authorization invariants is distinct from prompt injection and not fully covered by existing access control models. They formalize the problem and outline seven requirements for future authorization architectures, emphasizing the need for identity governance to be treated as core infrastructure. AI