[Theme] Security framework and requirements for authorization and privilege lifecycle management of AI agents

Theme Name

Security framework and requirements for authorization and privilege lifecycle management of AI agents

Proposer(s)

Ying Wang, China Unicom
Ye Tao, China Unicom

Summary

AI agents are autonomous, networked software entities that act on behalf of users, services, or organizations. In complex task execution, the privileges held by an AI agent are not static: they are created and bound at initialization, adjusted as tasks progress and the agent's authority evolves, suspended and isolated during hibernation, re-validated and restored upon activation, and must be fully revoked and recovered when a task completes or the agent terminates. The complete sequence of these state transitions constitutes the privilege lifecycle.
Authorization and privilege lifecycle management enables AI agents to hold only the privileges they need, precisely when they need them, under controlled and auditable conditions. Authorization decisions determine whether, when, and to what extent an agent may exercise its privileges; privilege lifecycle management governs the states those privileges pass through. Authorization precedes and determines the granting of privileges, and privilege lifecycle management subsequently governs the full lifecycle state transitions of authorized privileges - the two processes are sequential and tightly coupled. Lifecycle transitions and authorization decisions may occur within a single trust domain or across different trust domains. Each lifecycle phase and each authorization dimension introduces unique security challenges.
The authorization framework defined in this Issue covers the following security dimensions: separation of decision and enforcement functions with independent verifiability; adaptive authorization, which makes decisions based on real-time context and risk assessment; intent-based authorization, which binds authorization to the explicit purpose and scope of the agent's actions; zero-trust authorization, which applies continuous verification and least-privilege principles; credential and token security, which ensures full-lifecycle security of authorization evidence; human oversight, which requires human approval for high-risk operations; cross-domain authorization, which reconciles policy consistency across trust domains; and audit and accountability, which ensures all authorization decisions are traceable and tamper-evident. Together, these dimensions constitute a defense-in-depth approach for AI agent authorization security.
The privilege lifecycle management specified in this Issue covers five key phases: the initialization phase, which requires that initial privileges be assigned to the agent based on the least-privilege principle and bound to a verifiable identity; the change phase, which requires that any modification of privileges (including elevation, restriction, and inter-agent propagation) be evaluated against the current authorization context in real time; the hibernation phase, which requires that privileges be suspended and cryptographically isolated when the agent is non-operational and not exercisable; the activation phase, which requires mandatory re-assessment before privilege restoration to verify that the environment has not changed in ways that invalidate the original privilege assumptions; and the revocation and recovery phase, which requires that privileges be irreversibly revoked upon task completion or agent termination, cascading through all propagation paths, with verification of complete cleanup across all affected systems. In addition, full-lifecycle governance serves as a cross-cutting control layer across all phases, requiring immutable audit trails, real-time monitoring and anomaly detection, automated privilege reviews, policy version control, and compliance mapping, ensuring end-to-end controllability and traceability of privileges from grant to revocation.

Scope / Open Questions

This Issue draft specifies a security framework and security requirements for authorization and privilege lifecycle management of artificial intelligence (AI) agents. In this framework, authorization enables AI agents to obtain the privileges they need under controlled and auditable conditions; privilege lifecycle management governs the full state transitions of those privileges from grant to revocation. This Recommendation also identifies relevant security threats, and specifies the security requirements.
The scope of this Issue draft includes:
- Security threats for authorization of AI agents, and the corresponding security framework and security requirements;
- Security threats for privilege lifecycle management (including initialization, change, hibernation, activation, revocation and recovery, and full-lifecycle governance) of AI agents, and the corresponding security requirements.

NOTE – The specific definition, internal structure, and functional of an AI agent are outside the scope of this draft . The underlying authorization protocols and infrastructure such as OAuth, GNAP, X.1250-series IdM systems, are also outside the scope.

Related Work

ITU-T SG17 (Study Period 2025) Contribution 676, published on 24 August 2026, proposes a new work item, X.aplm-aia: "Security framework and requirements for authorization and privilege lifecycle management of AI agents."
Link: https://www.itu.int/md/T25-SG17-C-0676/en

Related Themes

Discussion