Why should you care?

Hospital resident and attending roles see different patient tools; ERP agents cannot post journals without Finance role.

See it live — copy this example

Paste into an ASP.NET Core 8+ / AgentNest project, then run with dotnet run (set your API keys in user-secrets).

// AgentNest.Security/AiAuthorizationHandler.cs
public sealed class AiToolAuthorizationHandler : AuthorizationHandler<ToolInvocationRequirement, KernelFunction>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context, ToolInvocationRequirement req, KernelFunction resource)
    {
        var allowed = context.User.FindAll("tool").Select(c => c.Value).ToHashSet();
        if (allowed.Contains(resource.PluginName + "." + resource.Name))
            context.Succeed(req);
        return Task.CompletedTask;
    }
}

What happened?

• AuthorizationHandler checks JWT tool claims against requested KernelFunction.
• CRM users with crm.read only cannot invoke crm.sendEmail.

Practice next

1. Emit tool claims from Entra app roles at token issue.
2. Register AiToolAuthorizationHandler in Program.cs.
3. Wrap auto tool invoke with IAuthorizationService.CheckAsync.
4. Add record-level CRM filter inside plugin using user id claim.
5. Cache authorization decisions 60s per user/tool.

Remember

Authorize each tool invocation, not just /api/ai routes. Map Entra roles to tool claims for AgentNest plugins. Fail closed when claims missing.

Finance journal guard

Analyst attempts ERP agent journal post without FinanceTools role.

Outcome: Authorization handler blocks gl.post_journal before SQL runs.