For every privileged action an agent attempts — not just at session start — route the request through a centralized policy engine that evaluates current authority. The policy engine checks: Who is the original requesting user? What is the current state of their permissions? Is this specific action within their current authorization? Is the agent presenting a valid, non-stale credential for this action?

This is a Policy Enforcement Point (PEP) / Policy Decision Point (PDP) architecture applied to agentic actions. Every sensitive action is a runtime authorization decision — not a stored permission lookup.

Directly stops cross-agent trust exploitation (Scenario 03) — the finance agent can no longer blindly trust the email agent's forwarded instruction without a re-verified authorization check. Also stops workflow authorization drift (Scenario 05) — by re-checking authority at the point of the transaction, not just at the start of the workflow.

Per-action authorization adds latency to every privileged action. For high-frequency, low-privilege actions this overhead may be unacceptable. A practical implementation tiers authorization: low-risk actions use session-cached tokens, medium-risk actions use per-task tokens, high-risk or irreversible actions require real-time policy evaluation. Define "high-risk" explicitly — don't leave it to judgment.