An AI agent sends this request:
POST /v1/customers/1287/refunds
Authorization: Bearer eyJ...
Content-Type: application/json
{
"amount": 1200,
"reason": "Customer reported duplicate charge"
}
An AI agent presents a valid JWT and asks a billing API to issue a refund. The token is correctly signed, unexpired, and belongs to the expected agent. Is that enough to execute the request?
No—but not because authentication failed.
Authentication did its job: it established a verifiable identity for the caller. The remaining questions are different. Is the refund within the agent's assigned policy? Does the request express the intent the endpoint is meant to serve? Is the action unusually risky for this agent? Has the agent recently produced violations or required repeated human intervention? Should the request be allowed, denied, or held for review?
An AI agent presents a valid JWT. Its issuer is trusted, its signature is valid, its audience is correct, and its token has not expired.
The agent then asks a billing API to issue a high-value refund.
Should the request be allowed?
Authentication can establish which workload is making the request. It cannot, by itself, establish whether this action is appropriate now, for this resource, with this inferred purpose, under the current risk conditions. A token answers an identity question. Governance must answer a decision question.