Downstream authorization is the set of permission checks enforced by the system that receives a request, such as an API, database, repository, or admin console. In an AI workflow, the model may propose or trigger an action, but the downstream service decides whether that action is allowed. This is different from model safety filters, which only judge the output before it is sent.
It matters because agentic systems often act through tools and credentials. If downstream authorization is weak, a model or attacker can turn a simple prompt or tool call into a real write, delete, or exfiltration event. Good defenses use least privilege, scoped tokens, role checks, approval gates for high-impact actions, and detailed logs so every action can be traced. In practice, downstream authorization is what limits blast radius when an AI agent misbehaves, is tricked by prompt injection, or gets access to a tool it should not control.