Intent-Based Access Control is a permission model that grants access only for the specific purpose of a request. Instead of giving a user or agent broad, standing privileges, the system checks whether the action matches the stated intent, such as reading one record, exporting one report, or approving one workflow step.
This matters in cyber security because compromised credentials, poisoned inputs, or overpowered automation can turn a single request into a larger breach. With intent-based controls, an AI agent or application can be limited to the task at hand, reducing the blast radius if it behaves unexpectedly. Defenders use this approach to require explicit approval for high-risk actions, log what purpose was claimed, and revoke access when the task ends. It is a practical way to apply least privilege to modern tools, APIs, and agentic systems.