What is actually new here
Authorizing software has been a solved problem, in outline, for decades: identify the caller, check its permissions, enforce the result. Autonomous agents strain that model in a few specific ways. They act at a speed no human reviewer can keep pace with, they can chain many small permitted actions into a large unintended effect, and their behavior can be influenced by inputs — a document, a webpage, a message — that were never meant to carry instructions.
That last point deserves its own emphasis: an agent that reads untrusted content as part of its task can be manipulated into taking actions the content's author wanted, not the ones its operator intended. Authorization built for that risk cannot rely on the agent's own judgment about what it should do; it has to constrain what the agent is capable of doing, regardless of what it decides to attempt.
Constraining capability instead of trusting judgment
The practical response is to treat an agent the way a zero-trust architecture treats any other principal: narrow, explicit, revocable authority, scoped to the specific task at hand, verified at the point of each consequential action rather than granted once at the start of a session. An agent authorized only to read a specific set of files cannot be talked into deleting a database, no matter what instruction it encounters along the way.
This is a stronger requirement than it sounds. It means resisting the operational convenience of giving an agent broad standing access because narrowly scoping every task is more work up front. The cost of that convenience is a blast radius that scales with everything the agent could touch, not just what a given task actually needed.