Context-aware authorization is an access-control approach that does not rely on a fixed role alone. It evaluates the purpose of the task, the sensitivity of the data involved, the identity of the actor, and the current risk level before granting or denying access. In practice, this means a system may allow a request in one workflow step but reject the same request in another if the context has changed.
This matters because cyber attackers often abuse overly broad permissions after stealing credentials, hijacking sessions, or compromising an automated agent. Static roles can grant more access than a task needs, creating unnecessary blast radius. Defenders use context signals such as data classification, device or session trust, request timing, and approval state to enforce least privilege, issue short-lived permissions, and revoke access quickly when risk rises. In modern environments, especially with AI agents and service accounts, context-aware authorization helps keep authority tied to the specific action being performed.