Curriculum · Phase 7 · Module 7.4

AI Access Controls + LLM Authorization

The defenses in the last module kept circling back to one fix: scope what the AI can reach. This module makes that the whole subject — authorization applied to AI. It covers the four questions behind every AI call (which identity, which model, which data, which action), the identity types you must tell apart (human user, service account, and autonomous agent), and RBAC/ABAC/ReBAC applied to models and data under least privilege and deny-by-default. Then it covers OAuth for AI: delegated versus service identity, the on-behalf-of flow, scoped short-lived tokens, and tool/MCP authorization — the controls that stop an AI from becoming a confused deputy with standing access to everything. You finish by designing an access matrix for six personas.