Principle
Run agent actions in the user's authorization context
A helpful assistant should not quietly become a shared administrator.
When it fits
- An AI acts on behalf of different users against shared downstream systems.
When to avoid it
- User-context execution does not make malicious or mistaken user requests safe; policy and high-impact approval may still apply.
Why it matters
Carry the initiating user's identity and allowed scope into downstream calls instead of using one generic high-privilege service identity for everyone. Let the destination system enforce what that user can access. This keeps the agent from turning a reasoning mistake into cross-user authority.
An example
A repository assistant uses the user's OAuth scope for the selected repository rather than a token that can edit every repository in the organization.
Check your result
Changing the user changes the resources and actions the downstream system authorizes.
Keep this limit in mind
- User-context execution does not make malicious or mistaken user requests safe; policy and high-impact approval may still apply.
Connected ideas
Useful withEnforce permissions outside the model
Evidence and sources
OWASP recommends executing agent extensions in the specific user's authorization context with the minimum necessary scope.
User-context execution still requires server-side authorization and does not make every requested action legitimate.
LLM06:2025 Excessive Agency · Execute extensions in user's context