Tool Permission Management — References

Access-control models that predate agents, the authorisation systems built on them, and the specific hazard an intermediary acting for someone else creates.

Models

• Guide to Attribute Based Access Control (ABAC) Definition and Considerations — NIST Special Publication 800-162. The reference treatment of decisions computed from attributes of subject, object, action, and environment, which is the shape an argument-aware rule takes. Cited by name.
• Role-Based Access Control — the NIST model and the ANSI/INCITS standard derived from it, including role hierarchies and separation-of-duty constraints. Named without a link, as the standard is not openly published at a stable address.
• eXtensible Access Control Markup Language (XACML) Version 3.0 — OASIS Standard. The canonical separation of policy decision point, policy enforcement point, and policy information point, which is the vocabulary for arguing about where a check belongs. Cited by name.

Systems

• Zanzibar: Google's Consistent, Global Authorization System (Pang et al.), USENIX ATC 2019 — relationship tuples, the consistency model behind them, and the argument for a central authorisation service. Cited by name; the open-source systems derived from it are listed in the stack note.
• Open Policy Agent — decoupled policy evaluation with a dedicated rule language, including the partial-evaluation and bundle-distribution mechanics that make fail-closed behaviour practical.

Acting on someone else's behalf

• The Confused Deputy (or why capabilities might have been invented) — Norm Hardy, ACM SIGOPS Operating Systems Review 22(4), 1988. The reason a component holding authority of its own cannot safely act on instructions from a less privileged source. Cited by name.
• RFC 8693: OAuth 2.0 Token Exchange — the explicit distinction between delegation and impersonation, which is the formal version of deciding on the intersection of two identities.

Agent-specific risk framing

• OWASP Cheat Sheet Series — the authorisation and access-control sheets, which cover enforcement placement and insecure direct object references in terms that transfer directly to argument-level rules.

No verified reference is recorded for human-in-the-loop approval design in agent systems, for measuring approval fatigue, or for standing-grant scope languages. These are product decisions with no published basis.