AI agents act for people, choose their own actions at runtime, and read content that may be hostile. This post sets out the problem, the three layers needed to handle it, and a reference architecture built on standards that exist today.

Part 4 ended where the MCP spec ends: the token is valid for this server. This part covers the question that comes next on every request. May this agent, for this user, call this tool with these arguments, right now? The standard for asking it is the OpenID AuthZEN Authorization API 1.0, Final since …

Agents act while the user is somewhere else. Sooner or later a decision needs a person: to grant access in the first place, to prove it is really them, to approve something they cannot approve alone, or to confirm one specific action. This part maps each of those moments to the standard that handles …