AI Agent Identity and Permission Governance Automation: Access Is an Intersection, Never a Union

Give an AI agent an identity, a credential to authenticate with, and access to a couple of internal systems, and each of those three grants gets configured by a different person at a different time, usually for a specific, narrow reason. None of those grants is wrong on its own. The risk appears the moment a system ASSUMES that having any one of the three is enough — that a valid credential implies the identity is trustworthy, or that access to a system implies the credential authorizes every action on it. That assumption is what lets partial, individually reasonable grants combine into an access level nobody actually approved, and it is exactly the failure mode a governance layer needs to refuse by construction rather than catch after the fact.

Most access systems answer a single question — does this identity have a credential for this system — and treat "yes" as the end of the analysis. That collapses several genuinely separate questions into one: is the identity itself still trustworthy, is the specific credential still valid, does the requested action fall inside the scopes the ASSET actually grants, and does the moment, place and purpose of the request match what was approved. Answering only the first question is how partial grants combine into something nobody intended — the fix is not a smarter yes/no check, it is refusing to answer yes unless every layer, independently, already says yes.

Every agent carries four permission layers — identity scopes, credential scopes, asset scopes and, when the system declares any, system scopes — and its effective permission is their INTERSECTION, computed fresh on every check, never cached as a standing union. An empty layer means no access from that source (fail-closed), with one deliberate exception: an empty system-scope layer is read as "the system adds no further restriction," not as "the system grants everything." Explicit policy denials are then subtracted from whatever remains. That effective set is only the first gate. A specific request also has to pass a contextual layer checking that the identity can currently authenticate (not suspended, revoked, expired or marked compromised), that the credential itself is valid, that the agent's lifecycle state currently allows operation, that the environment, purpose and time window match what was approved for this agent, and — for scopes flagged as requiring it — that a live human approval actually exists right now, even if the scope is technically inside the effective set. Underneath all of that sits a 14-state lifecycle machine — requested, in development, in test, in homologation, awaiting evaluation, approved, approved with restrictions, active, suspended, quarantined, compromised, discontinuing, discontinued, archived — where the absence of a listed transition is itself a denial: an agent cannot skip from "in development" to "active" because no such transition exists in the table. Two guards sit outside the table entirely: an agent cannot enter production without a registered human owner, and an agent marked compromised can only be moved out of that state into quarantine, and only once an investigation is marked complete and new credentials have been issued — reactivating straight to active is not a legal transition from compromised under any condition.

A security review flags unusual behaviour from a customer-support AI agent and marks its identity as compromised. Under the lifecycle table, compromised has exactly two legal exits: quarantine or discontinuing. The team quarantines it. From quarantine, the table again narrows the options — the agent cannot return to active, because the guard requires an investigation to be marked complete and new credentials to have been issued first. The investigation takes two days; once it closes and a fresh credential is generated, the transition back to active becomes legal and the agent resumes work.

Separately, one of the agent's scopes was already flagged as requiring live approval regardless of what the effective permission set contained. Even during the period when the agent was technically back in the "active" state with that scope inside its intersection, a specific request using that scope was still denied, because no current approval existed for it at that moment — the effective-permission check and the approval-required check are genuinely independent gates, and both have to pass.

The structural change is that "does this agent have access" stops being answerable by checking any single layer and becomes a question that requires every layer to agree, every time. Partial grants stop silently combining into something nobody approved. A compromised agent cannot quietly return to normal operation on the strength of one person deciding it looks fine now. And a lapsed review has a real, automatic consequence — a downgrade — rather than depending on someone noticing the date. Centriu attaches no figure to what that prevents; it depends entirely on how many agents, credentials and systems an organization is governing.

An organization running a single AI assistant with one credential and no separate systems to scope access against has little use for a four-layer intersection model — there is nothing to intersect. The value appears once multiple agents, multiple credentials and multiple internal systems exist together, which is exactly the condition under which partial grants start combining unintentionally.

The common approach checks one thing — does this identity have a credential for this system — and calls that sufficient. It is fast to build and it is precisely the design that lets independently reasonable grants add up to something nobody intended. Centriu TrustOps's approach is structurally different: no single layer can grant access on its own, every layer has to agree, and the agent's own lifecycle state is itself one more gate that can override an otherwise-valid permission set. The trade is complexity at setup — four layers to configure instead of one — for the specific guarantee that access never grows by accident.