The ReBAC framing makes sense for agents that act as delegates of a known human principal — the agent inherits relationships the human already has within the org. But there's a gap when agents operate as first-class external actors that don't map onto any existing user account. An AI agent sending emails, making API calls, or acting in workflows on behalf of another agent doesn't have a natural home in most ReBAC graphs. The relationships need to be defined from scratch, and there's no HR system or SSO directory that seeds them.
The inference firewall concept is interesting though. Pre-retrieval enforcement is strictly better than post-hoc logging — by the time you're auditing what got retrieved, the mosaic effect has already happened.
The ReBAC framing makes sense for agents that act as delegates of a known human principal — the agent inherits relationships the human already has within the org. But there's a gap when agents operate as first-class external actors that don't map onto any existing user account. An AI agent sending emails, making API calls, or acting in workflows on behalf of another agent doesn't have a natural home in most ReBAC graphs. The relationships need to be defined from scratch, and there's no HR system or SSO directory that seeds them.
The inference firewall concept is interesting though. Pre-retrieval enforcement is strictly better than post-hoc logging — by the time you're auditing what got retrieved, the mosaic effect has already happened.