Access Control Models Explained: From DAC to AI Agents

Traditional access control models such as DAC, MAC, ACLs, RBAC, ABAC, and capability-based security are insufficient for modern AI platforms where autonomous agents act on behalf of humans across chained tools, requiring a composed approach that combines identity, context, delegation, isolation, least privilege, and auditability. The article argues that every agent invocation must be treated as an authorization event with its own actor, principal, scope, purpose, and traceable parent request, and that RBAC remains useful for stable organizational boundaries while contextual policies and isolated execution environments handle fluid AI operations.

Your access model may have been designed for employees, but your production environment now contains people, service accounts, integrations, and AI agents acting through chained tools. A support agent can read a ticket, query a CRM, draft a reply, and trigger an update under a workflow that began with one human request. If your authorization layer records only “agent used tool,” you may not know who initiated the action, what authority was delegated, which data boundary applied, or whether the permission should still exist. That's why choosing among access control models is no longer a documentation exercise. DAC, MAC, ACLs, RBAC, ABAC, and capability-based security each solve a different authorization problem. Modern AI platforms need a composed approach that combines identity, context, delegation, isolation, least privilege, and auditability. Table of Contents The Evolution of Access Control Beyond Humans the-evolution-of-access-control-beyond-humans Foundations of Discretionary, Mandatory, and List-Based Models foundations-of-discretionary-mandatory-and-list-based-models Implementing Role-Based Access Control for Teams implementing-role-based-access-control-for-teams Context-Aware Alternatives to Role-Based Security context-aware-alternatives-to-role-based-security The Governance Gap in Autonomous Agent Workflows the-governance-gap-in-autonomous-agent-workflows Operationalizing Access Control with Multi-Instance Architecture operationalizing-access-control-with-multi-instance-architecture Best Practices for Securing Your AI Workforce best-practices-for-securing-your-ai-workforce The Evolution of Access Control Beyond Humans The word “user” has become too narrow for modern systems. A human employee may open an application directly, but an AI agent can act on that employee's behalf, invoke several services, pass information between tools, and create follow-up tasks without another click. The authorization question is no longer only whether an identity has permission. It's also which actor is acting, for whom, against what resource, under which purpose, and for how long . Traditional enterprise security assumed relatively stable relationships. A person belonged to a department, received a role, and used a predictable set of applications. That structure still works well for many employee workflows. It becomes harder to manage when one agent serves several customers, operates across isolated workspaces, or receives temporary authority for a single task. The boundary between a tool and an agent has also blurred. A passive integration waits for a command. An autonomous agent can select tools, interpret results, retry failed actions, and make decisions inside a workflow. Each step can create a new authorization event, even when the original request came from one person. Practical rule:Treat every agent invocation as an authorization event with its own actor, principal, scope, purpose, and traceable parent request. A secure platform therefore needs more than a user-to-permission mapping. It needs a model that can preserve causality across a chain of actions. The system should be able to answer whether an agent acted with direct authority, delegated authority, or a credential inherited from another service. It should also distinguish a read operation from a write, an internal record from a client record, and a temporary workflow grant from a standing entitlement. This doesn't make classic access control models irrelevant. It changes where they fit. RBAC remains useful for stable organizational boundaries, while contextual policies and isolated execution environments handle the fluid parts of AI operations. Foundations of Discretionary, Mandatory, and List-Based Models The foundational models differ mainly in who controls access and how rigidly the system enforces policy . Discretionary Access Control, or DAC , lets a resource owner decide who can access an object. A file owner may grant another user read or write permission, and that recipient may sometimes pass access onward. DAC is flexible and easy to understand in small environments, but that flexibility creates risk. Owners may grant access without understanding the downstream consequences, and permissions can spread beyond the original business purpose. Mandatory Access Control, or MAC , moves the decision away from the resource owner. The system enforces security labels, classifications, and clearance rules. A user can't share a restricted document because the policy engine determines whether the user's clearance and the resource's classification are compatible. MAC suits environments where information-flow rules must resist user discretion, although administrators must maintain accurate labels and a policy structure that matches operational reality. Access Control Lists, or ACLs , provide the concrete permission entries attached to a resource. An ACL may identify users, groups, or service identities and specify actions such as read, write, or execute. ACLs can support either discretionary or centrally governed policies, but they become difficult to review when every resource accumulates individual exceptions. Where these models fit The practical boundaries are clear: DAC works for ownership-driven collaboration: It's useful when users legitimately control personal or team-owned resources and the environment can tolerate local decisions. MAC works for high-assurance classification: It's appropriate when administrators must enforce information-flow rules that users can't override. ACLs work for explicit exceptions: They're effective for resource-specific permissions, but they're a poor substitute for a coherent organization-wide authorization strategy. ACLs are often the mechanism engineers see in a cloud storage bucket, operating system, database, or SaaS application. The mechanism isn't the same as the governance model. A team can build a sound policy with ACLs, but it must still answer who owns the resource, how access is reviewed, how inherited permissions behave, and how quickly revocation takes effect. For AI workflows, direct ACL management usually fails when agents touch many resources across multiple systems. A permission list may say an agent can access a repository, but it won't necessarily explain whether the agent should access a customer record discovered through that repository or pass the record to another tool. The more dynamic the workflow, the more valuable an abstraction above individual resource entries becomes. Implementing Role-Based Access Control for Teams Role-Based Access Control, or RBAC , separates people from permissions. Instead of assigning every permission directly to every employee, an administrator defines roles such as support analyst, billing reviewer, or workspace administrator. Users receive roles, and roles receive permissions. That separation makes access easier to operate. A role can represent a job function, while the identity directory handles membership. When an employee changes teams, security staff can change the assignment rather than manually editing access across every application. Build roles around work, not org charts Start with the actions a team performs. “Marketing” may be too broad to define safe permissions, while “campaign editor” or “analytics viewer” gives engineers a more useful boundary. Separate read, create, update, delete, export, and administrative actions instead of bundling them into one powerful role. Use role hierarchies when a senior function should inherit a carefully defined base set of permissions. A team lead may need the analyst permissions plus approval rights, but hierarchy should never become an excuse to grant unrestricted administration. Separation of duties is equally important. The person who creates a payment rule shouldn't automatically approve the same rule. A deployment operator may execute a release without being able to change the production policy that authorizes it. These constraints reduce conflict-of-interest risk and make internal review more meaningful. RBAC's formal history matters because it explains why the model became such a durable enterprise standard. NIST records that David Ferraiolo and Rick Kuhn formally defined RBAC at NIST in 1992 , including role hierarchies and separation-of-duty constraints. NIST later consolidated that work with the Sandhu et al. framework in 2000 , and the resulting U.S. consensus standard became ANSI/INCITS 359-2004 in February 2004 , followed by a revision in 2012 . NIST also notes that ad hoc role-based systems existed since the 1970s , so formalization converted a long-running practice into a standardized authorization model. See the NIST history of Role-Based Access Control https://csrc.nist.gov/projects/role-based-access-control . Implementation test:If an engineer can't explain why a role exists in terms of repeatable work, the role probably encodes organizational convenience instead of least privilege. RBAC remains the right default for stable employee access, but teams should monitor role explosion. Too many narrowly customized roles recreate direct user permissions under different names. Keep roles understandable, document owners, review membership, and reserve exceptions for policies that depend on context. Physical and digital credentials raise similar operational questions. Teams working with regulated client records may also benefit from reviewing access key best practices for lawyers https://ciphar.org/blog/how-to-use-access-keys , particularly around ownership, storage, rotation, and controlled sharing. The same discipline applies to service credentials used by agents. Context-Aware Alternatives to Role-Based Security RBAC answers, “What can someone in this role do?” Attribute-Based Access Control, or ABAC , asks a broader question: “Do the identity, resource, action, and current environment satisfy this policy?” An ABAC decision might evaluate the user's department, the resource owner, the requested operation, the device posture, the network location, the time window, and the sensitivity of the data. That flexibility helps when access depends on conditions that don't map cleanly to a job title. Capability-based security takes a different route. Instead of consulting a central list for every relationship, the system grants possession of an unforgeable capability that represents authority over a particular resource or action. Capabilities can support fine-grained delegation, but teams must design reliable expiration, revocation, storage, and transfer controls. Compare the operational trade-offs | Model | Strong fit | Main operational concern | |---|---|---| | RBAC | Stable workforce functions and administrative boundaries | Role sprawl and coarse permissions | | ABAC | Dynamic, context-sensitive decisions across data and environments | Policy authoring, testing, and troubleshooting | | Capability-based security | Narrow delegation and decentralized authority | Revocation, discovery, and safe capability handling | ABAC can reduce the need to create a new role for every combination of department, location, resource type, and action. It also introduces a policy language that engineers must test like code. A policy that looks precise on paper can produce unexpected results when attributes are missing, stale, or supplied by an untrusted system. Capabilities can make authority explicit in a workflow. An agent may receive a capability to update one ticket rather than broad access to an entire support database. That design limits blast radius, but delegation becomes harder if the receiving agent needs to pass a narrower authority to another agent. Many production systems combine the models. RBAC establishes the baseline for a team or instance. ABAC adds conditions such as tenant, resource sensitivity, and workflow state. Short-lived capabilities or signed grants can constrain individual actions. This layered design is more complex than selecting one model, but it reflects the actual structure of modern applications. The Governance Gap in Autonomous Agent Workflows An AI agent can inherit a permission that looks harmless in isolation and still create an unsafe chain of authority. A user may authorize a customer-support task, the agent may retrieve a customer profile, call a billing tool, and send an external message. A traditional RBAC check at each tool boundary may confirm that the agent has a role, yet fail to establish whether the complete workflow is allowed. The governance problem is measurable. A 2026 industry report found that more than two-thirds of organizations can't clearly distinguish AI-agent actions from human actions , as reported by the Cloud Security Alliance coverage of AI-agent accountability https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions . If logs collapse the initiating user, the executing agent, and the downstream service into one identity, investigators lose the causal chain they need. Classic RBAC also struggles with resource relationships, transitive delegation, and workflow-scoped authorization in multi-agent systems. A role can say that an agent may use a CRM tool, but it doesn't naturally express that the agent may access only records related to the current customer, only for a support purpose, and only while the parent task remains active. Design delegation as a first-class security object A safer agent authorization record should preserve: Initiating principal: The human, service, or scheduled process that started the task. Executing identity: The specific agent instance that performed each action. Delegation chain: The authority passed from the initiator to the agent and, where applicable, to another tool or agent. Resource scope: The tenant, project, record set, or object boundary affected by the action. Time and workflow limits: Conditions that automatically end authority when the task expires, completes, or changes state. Causal trace: The request, tool call, result, and subsequent action connected in an auditable sequence. Teams building advanced AI workflow orchestration https://appjet.ai/blog/multi-agent-orchestration should model those relationships before adding more tools. More tools increase the number of possible paths an agent can take, so authorization must evaluate the workflow context rather than merely approve each connector independently. A practical agent deployment also needs an execution boundary. The Hermes agent deployment environment https://donely.ai/hermes-agent illustrates the type of platform boundary teams should evaluate, including how an agent instance is hosted, what it can reach, and how its activity is represented in logs. The following video provides additional context for teams assessing autonomous workflow design. Treat it as implementation background, not as a replacement for threat modeling and policy tests. Operationalizing Access Control with Multi-Instance Architecture Authorization becomes easier to reason about when the platform separates workloads before tools execute. Multi-instance architecture gives each customer, department, or operational purpose an isolated runtime boundary. The instance can hold its own configuration, credentials, agent state, and data scope instead of relying on a single shared process to enforce every distinction. That separation doesn't replace RBAC. It gives RBAC a smaller and more meaningful domain. A user may be an administrator in one instance and a read-only collaborator in another. An agent may have access to a sales workspace without gaining access to a client's support workspace, even if both workloads run on the same platform. Map the controls to the runtime A practical design usually combines four controls: Per-instance permissions: Assign roles and permissions within each instance, not only across the global account. This prevents a legitimate business role from becoming universal authority. Scoped data access: Give each agent only the records, folders, projects, or tools needed for its assigned workload. Credential scope should follow the instance boundary. Isolated execution: Use separate containers or equivalent runtime boundaries so one workload can't casually inspect another workload's files, processes, or secrets. Unified audit visibility: Centralize status, events, and authorization records while preserving the identity of the instance, agent, initiating user, and tool action. This pattern supports agencies that manage multiple clients, internal teams that separate production from experimentation, and founders who want personal and business automation without mixing credentials. It also reduces the impact of a misconfigured integration because the error remains bounded by the affected instance. Donely provides per-instance RBAC, isolated containers, scoped data access, and unified audit logs for AI employee deployments. Teams evaluating hosting details can review the Hermes agent hosting approach https://donely.ai/hermes-agent/hosting and verify how instance boundaries, credentials, monitoring, and administrative access fit their own threat model. The important design choice is to make isolation structural rather than procedural. A policy review can catch mistakes, but a separate runtime and data scope make accidental cross-tenant access harder in the first place. Security teams should still test escape paths, inspect inherited permissions, and verify that dashboards and embeds honor the same instance-level rules as APIs and background jobs. Best Practices for Securing Your AI Workforce Agent access should receive the same governance discipline as employee privilege, with extra controls for delegation and automation. Start with a clear inventory of agents, tools, credentials, data stores, initiating principals, and workflows. Assign an owner to each access policy, then test both allowed and denied paths. Usage logs help, but they can't prove that observed actions represent the full entitlement set. Research on ABAC policy mining warns that logs are incomplete and provide only a lower bound on entitlements, which means deriving permissions from activity alone can still over-assign access. The research on policy mining from audit logs https://www3.cs.stonybrook.edu/~stoller/papers/1403.5715v4.pdf is a useful reminder to validate generated policies against declared business requirements, not just historical behavior. Use this operating checklist: Start narrow: Grant the smallest tool and data scope that completes the workflow. Time-box delegation: End temporary authority when the task expires, changes state, or completes. Preserve causality: Record who initiated the request, which agent acted, and which downstream resources changed. Review drift: Compare policy intent with current roles, credentials, integrations, and instance configuration. Test failure paths: Confirm that missing attributes, revoked credentials, tool errors, and ambiguous ownership produce a deny decision. Separate environments: Keep personal, client, development, and production workloads in distinct instances or equivalent boundaries. Teams can use platforms such as Donely's AI employee environment https://donely.ai/ai-employees as one option to evaluate for per-instance governance, scoped access, agent deployment, and centralized operational visibility. The platform choice matters less than whether its controls expose the evidence security reviewers need. Adopt zero-trust assumptions throughout the workflow. Authenticate every actor, authorize every sensitive action, minimize standing privilege, and treat agent output as untrusted until policy permits the next step. Continuous validation is the difference between an access model that looks correct during deployment and one that remains safe as tools, users, data, and workflows change. Donely lets teams host, deploy, and manage AI employees with per-instance RBAC, isolated containers, scoped data access, and unified audit logs. Visit Donely https://donely.ai to evaluate a practical path for separating workloads and governing autonomous agents without building the entire operations layer yourself.