Runtime Authorization — 7 articles

7 articles from Crelis on Runtime Authorization. Most recent: “State of Agentic AI Security and Governance: What the 2026 Report Records”.

• State of Agentic AI Security and Governance: What the 2026 Report Records — 16 September 2026

  OWASP gives teams a dated field reference for agentic AI risk, not proof that a live action was authorised.

• Singapore's Generative AI Transparency Guidelines: What They Ask You to Disclose — 15 September 2026

  Transparency can explain that AI was involved. It does not prove that an agent had authority to release money, delete a record, or change a credit limit.

• NIST's AI Agent Standards Work: What Is In Scope — 14 September 2026

  NIST's agent standards work matters, but it does not prove that a payment release, deleted record, or changed credit limit was authorised.

• MCP Elicitation: What "User Explicitly Approved" Does and Does Not Record — 11 September 2026

  MCP approval can move a workflow forward, but the specification text separates transport authorization, elicitation, and later evidence of who had authority for a particular tool call.

• MCP Authorization and OAuth: What the Spec Delegates to You — 9 September 2026

  OAuth helps MCP clients reach servers, but it does not prove why a payment release, record deletion, or credit-limit change was allowed.

• What OWASP's Agentic Threat Taxonomy Says About Authorization Failures — 8 September 2026

  OWASP gives agentic AI teams a threat model, not proof that a payment, deletion, or credit change was authorised.

• Runtime Authorization vs Runtime Security: What's the Difference? — 20 August 2026

  Runtime security asks whether an AI agent's activity is a threat. Runtime authorization asks whether the action was permitted — and whether you can prove who permitted it.