针对 AI Agent 工具调用的默认拒绝授权机制与安全契约

On 2026-11-13, the AI section of DEV Community published a technical piece in which the author introduced the Agent Security Contract (ASC), a deny-by-default gate designed for AI Agent and MCP tool calls. The work was presented alongside a preprint titled "Fail-Closed Authorization for Tool-Using AI Agents: A Capability Contract and Case Study," which poses two questions: what admission checks for agent tool calls should look like, and what remains uncovered when teams rely only on a plain tool-level allowlist.

The design draws an explicit parallel to infrastructure practice. As the author notes, platform teams already enforce fail-safe defaults for Kubernetes objects through RBAC and admission controllers such as OPA/Gatekeeper and Kyverno. The ASC applies that same model to AI Agent behavior, standing in front of each agent or MCP tool call to decide whether it is permitted, and producing an audit trail comparable to what Kubernetes RBAC produces for object access. The stated aim is to close the gap that a pure tool-level allowlist leaves open, where a call is judged only by which tool it names and not by the broader context of the request.

At this point the contract exists only in the form of that preprint and the accompanying article. No additional implementation, adoption, or follow-up material has appeared, so the work remains at the proposal stage, with its design and intended coverage described but no further development reported.