I will go first. I run a multi tenant AI workspace. Every user has their own agent with its own tool list, and those tools reach real things, files, email, a browser, a database. Tenant isolation is enforced server side on every read and write, so it does not depend on the interface behaving. What I could not defend is one layer under that. When the agent calls a tool, the tool runs with the rights of the application, not the rights of the person who asked. The isolation is only as good as the code path sitting in front of it. There is no token in the middle saying this call is on behalf of this user and may touch only these things, because nothing in the stack issues one at that granularity. I know the shape of the fix. Short lived, per request, scoped to the caller. I have not built it yet, and working that out is most of why this room exists. Your turn. What are you building, and which part of it would not survive that question?

Hey Omkar, this is exactly the right instinct, and wanting to build it rather than just read about it is how you actually learn this space. Enforcing short lived, scoped authorization at the tool boundary is the heart of it, so you are starting in the right place. A few things to instrument early, because that is where it gets interesting. First, enforce at the moment of use, not just at the grant. It is easy to check the scope when you issue the token and then forget to check again when the agent actually calls the tool, so make an expired or narrowed grant genuinely stop working at redeem time. Second, decide up front what happens when the authorization service is unreachable. If the agent lets the action through when the policy engine is down, that is the opposite of secure, so fail closed and watch how that changes its behavior. Third, the two user delegation is where the real breakage lives. The agent is a deputy acting for both, and it should only ever narrow what each user could already do, never combine their permissions or exceed either one. That confused deputy problem is the whole reason this is hard, so build a case where user A's request quietly picks up user B's authority and see if your model catches it. This is the exact model I have been building, so I am genuinely interested to see where yours bends. Share it as you go and I will give you real feedback at each step.