An AI agent presents a valid JWT and asks an internal finance API to create a payment. The identity is authentic. The token is unexpired. The route is permitted by the agent's role.
Should the request execute?
An autonomous agent wants to update a customer record. Its HTTP request looks ordinary:
PATCH /v1/customers/42
Content-Type: application/json
{"creditLimit": 50000}
A conventional reverse proxy can terminate TLS, authenticate the caller, apply a rate limit, select an upstream, and forward the request. Those are essential controls. But the proxy still faces an agent-specific question: is this request a routine update, an unauthorized financial change, a confused tool call, or an action that should wait for human approval?
An AI agent presents a valid JWT and asks a billing API to issue a refund. The token is correctly signed, unexpired, and belongs to the expected agent. Is that enough to execute the request?
No—but not because authentication failed.
Authentication did its job: it established a verifiable identity for the caller. The remaining questions are different. Is the refund within the agent's assigned policy? Does the request express the intent the endpoint is meant to serve? Is the action unusually risky for this agent? Has the agent recently produced violations or required repeated human intervention? Should the request be allowed, denied, or held for review?
An AI agent presents a valid JWT. Its issuer is trusted, its signature is valid, its audience is correct, and its token has not expired.
The agent then asks a billing API to issue a high-value refund.
Should the request be allowed?
Authentication can establish which workload is making the request. It cannot, by itself, establish whether this action is appropriate now, for this resource, with this inferred purpose, under the current risk conditions. A token answers an identity question. Governance must answer a decision question.