Fail-closed authorization for AI agent tool calls, and the audit record behind it
Platform teams already enforce fail-safe defaults for Kubernetes objects with RBAC and admission controllers such as OPA/Gatekeeper and Kyverno. My preprint, Fail-Closed Authorization for Tool-Using A