Runtime authorization is the control layer that decides, while an AI system is operating, whether a requested action is allowed. Instead of trusting a model or workflow just because it was approved at launch, runtime checks evaluate each action against policy, identity, context, and risk. This can include access to files, APIs, databases, email, tickets, or other tools.
It matters because modern AI agents can do more than generate text: they can move data, trigger actions, and chain requests across systems. If an attacker hijacks a prompt, injects instructions, or abuses a compromised agent, runtime authorization can block unauthorized steps even when the model tries to proceed. Defenders use it with least privilege, human approval for sensitive actions, and continuous monitoring so that only the right action happens at the right time.