🤖 AI Summary
This work addresses the lack of fine-grained access control mechanisms on existing websites for agent-based AI systems, which hinders the secure delegation of critical tasks. To overcome this limitation, the authors propose and implement a web interaction architecture that enables AI agents to safely perform such tasks. By extending the access-granting protocol of an open-source authorization service, they integrate role-based, fine-grained permission management into AI-agent web interactions for the first time. The system features a co-designed frontend and backend along with customizable access control policies, resulting in a controlled website environment that can be securely operated by AI agents. Empirical evaluation demonstrates the feasibility and security of this approach in scenarios involving the delegation of critical tasks.
📝 Abstract
Recent studies reveal gaps in delegating critical tasks to agentic AI that accesses websites on the user's behalf, primarily due to limited access control mechanisms on websites designed for agentic AI. In response, we propose a design of website-based interaction for AI agents with fine-grained access control for delegated critical tasks. Our approach encompasses a website design and implementation, as well as modifications to the access grant protocols in an open-source authorization service to tailor it to agentic AI, with delegated critical tasks on the website. The evaluation of our approach demonstrates the capabilities of our access-controlled website used by AI agents.