---
title: "Discussion on \"Fail-closed authorization for AI agent tool calls, and the audit record behind it\" | Hashnode"
description: "Discussion on \"Fail-closed authorization for AI agent tool calls, and the audit record behind it\". Platform teams already enforce fail-safe defaults for Kubernetes objects with RBAC and admission controllers such as OPA/Gatekeeper and Kyverno. My preprint, Fail-Closed Authorization for Tool-Using A"
url: "https://hashnode.com/posts/fail-closed-authorization-for-ai-agent-tool-calls-and-the-audit-record-behind-it/6af6ec76f8d8584368c29d20"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Fail-closed authorization for AI agent tool calls, and the audit record behind it](https://justrunme.hashnode.dev/fail-closed-authorization-for-ai-agent-tool-calls-and-the-audit-record-behind-it?utm_source=hashnode&utm_medium=feed)

Platform teams already enforce fail-safe defaults for Kubernetes objects with RBAC and admission controllers such as OPA/Gatekeeper and Kyverno. My preprint, Fail-Closed Authorization for Tool-Using A

1h ago · 7 min read · justrunme.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#devops](https://hashnode.com/tag/devops)
-   [#ai](https://hashnode.com/tag/ai)
-   [#mcp](https://hashnode.com/tag/mcp)

## Written by

[Andrey Lesnikov](https://hashnode.com/@justrunme)

@justrunme · Germany

  
[View profile](https://hashnode.com/@justrunme)

Senior DevOps & AI Platform Engineer

Andrey Lesnikov is a Senior DevOps & AI Platform Engineer working on Kubernetes, GitOps, platform engineering and the security of tool-using AI agents. He is the author of the book "Prove It Before Production: Evidence-Driven Infrastructure Engineering for Kubernetes and GitOps" and of the preprint "Fail-Closed Authorization for Tool-Using AI Agents". He received the Cloud Native Rockstar Award 2026 (Company Award, 3rd place). More at justrunme.com.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.