ISO/IEC 27001:2022 agent permission and delegated access architecture for enterprise LLM — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · ISO/IEC 27001:2022 · layout spec_first · implementation executed in CI before publish

Deployment parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

The control that resolves this is an Intersecting Delegated Authority, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is ISO/IEC 27001:2022, and the question it actually asks is is this risk on the register with a named owner and a treatment. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The architecture friction point

The agent is given a service account so it can complete its work, and it now acts with more authority than any human who invokes it. An intern's request and an administrator's request reach the same powerful identity.

What ISO/IEC 27001:2022 specifically requires

ISO 27001 is a management-system standard: the auditor checks that risks are identified, owned, treated and reviewed on a cycle. A perfect technical control that is absent from the risk register is a nonconformity.

The artifact that satisfies it is risk register entries with owners, treatments and review dates. The way teams most often fail it: a technically sound control that no Statement of Applicability references, so it cannot be evidenced.

Reference implementation — Delegated authority as an intersection, with expiry

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the Statement of Applicability extract.

"""Delegated authority: an agent never exceeds the user it acts for.

The failure: an agent is given a service account so it can "do its job", and it
then acts with more authority than any user who invokes it. Correct delegation
is an intersection — the agent may do only what BOTH its own grant and the
invoking user permit — and it must be time-boxed, because a standing delegation
is a standing privilege.
"""
from dataclasses import dataclass


@dataclass(frozen=True)
class Grant:
    subject: str
    permissions: frozenset
    expires_at: int

    def valid(self, now: int) -> bool:
        return now < self.expires_at


class DelegationError(PermissionError):
    pass


class DelegatedAuthority:
    """Effective permissions = user ∩ agent grant, never a union, and never
    the agent's own service identity."""

    def __init__(self):
        self.users: dict[str, frozenset] = {}
        self.grants: dict[str, Grant] = {}
        self.audit: list[dict] = []

    def define_user(self, user: str, permissions: set) -> None:
        self.users[user] = frozenset(permissions)

    def delegate(self, agent: str, permissions: set, expires_at: int) -> Grant:
        g = Grant(agent, frozenset(permissions), expires_at)
        self.grants[agent] = g
        return g

    def effective(self, agent: str, user: str, now: int) -> frozenset:
        g = self.grants.get(agent)
        if g is None:
            raise DelegationError(f"no grant for agent {agent!r}")
        if not g.valid(now):
            raise DelegationError(f"grant for {agent!r} expired")
        if user not in self.users:
            raise DelegationError(f"unknown principal {user!r}")
        return g.permissions & self.users[user]

    def authorise(self, agent: str, user: str, action: str, now: int) -> bool:
        try:
            allowed = self.effective(agent, user, now)
        except DelegationError as exc:
            self.audit.append({"agent": agent, "user": user, "action": action,
                               "allowed": False, "reason": str(exc)})
            return False
        ok = action in allowed
        self.audit.append({"agent": agent, "user": user, "action": action,
                           "allowed": ok,
                           "reason": "" if ok else "outside the intersection"})
        return ok

    def chain(self, agent_a: str, agent_b: str, user: str, now: int) -> frozenset:
        """A delegating to B cannot widen authority — chaining intersects
        again, which is what stops escalation through a hop."""
        return self.effective(agent_a, user, now) & self.grants[agent_b].permissions


if __name__ == "__main__":
    da = DelegatedAuthority()
    da.define_user("analyst", {"read_reports", "read_pii"})
    da.define_user("intern", {"read_reports"})
    da.delegate("summariser", {"read_reports", "read_pii", "delete_records"},
                expires_at=100)

    assert da.authorise("summariser", "analyst", "read_pii", now=1) is True
    # The intern cannot read PII, so neither can an agent acting for them.
    assert da.authorise("summariser", "intern", "read_pii", now=1) is False
    # Nobody granted delete to a user, so the agent's own grant cannot supply it.
    assert da.authorise("summariser", "analyst", "delete_records", now=1) is False

    eff = da.effective("summariser", "intern", now=1)
    assert eff == frozenset({"read_reports"}), eff

    # Expiry is enforced, not advisory.
    assert da.authorise("summariser", "analyst", "read_reports", now=101) is False
    assert "expired" in da.audit[-1]["reason"]

    # Chaining must not widen authority.
    da.delegate("exporter", {"read_reports", "export"}, expires_at=100)
    chained = da.chain("summariser", "exporter", "analyst", now=1)
    assert chained == frozenset({"read_reports"}), chained
    assert "export" not in chained, "chaining widened authority"

    assert da.authorise("unknown_agent", "analyst", "read_reports", now=1) is False

    print("Delegated authority intersection: OK")
    print(f"  audit entries {len(da.audit)}, "
          f"denials {sum(1 for a in da.audit if not a['allowed'])}")

The ISO/IEC 27001:2022 control, as code

Statement of Applicability with operating evidence. This is the artifact an assessor asks for under ISO/IEC 27001:2022 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Annex A control to evidence mapping behind a Statement of Applicability.

ISO/IEC 27001:2022 turns on the SoA: every Annex A control is either applicable
with a justification and evidence, or excluded with a justification. The audit
failure is an applicable control whose evidence is a policy document rather
than a record that the control operated.
"""

ANNEX_A_2022 = {
    "A.5.23": "Information security for use of cloud services",
    "A.8.2": "Privileged access rights",
    "A.8.10": "Information deletion",
    "A.8.12": "Data leakage prevention",
    "A.8.15": "Logging",
    "A.8.16": "Monitoring activities",
    "A.8.24": "Use of cryptography",
    "A.8.28": "Secure coding",
}

EVIDENCE_KINDS = {"record", "configuration", "test_result"}
NON_EVIDENCE = {"policy", "intent", "roadmap"}


class StatementOfApplicability:
    def __init__(self, scope: str):
        self.scope = scope
        self.entries: dict[str, dict] = {}

    def apply(self, control: str, justification: str,
              evidence_ref: str, evidence_kind: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if evidence_kind in NON_EVIDENCE:
            raise ValueError(
                f"{control}: {evidence_kind!r} describes intent, not operation")
        if evidence_kind not in EVIDENCE_KINDS:
            raise ValueError(f"{control}: unknown evidence kind {evidence_kind!r}")
        self.entries[control] = {"applicable": True, "justification": justification,
                                 "evidence_ref": evidence_ref,
                                 "evidence_kind": evidence_kind}

    def exclude(self, control: str, justification: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if len(justification.split()) < 5:
            raise ValueError(f"{control}: exclusion needs a real justification")
        self.entries[control] = {"applicable": False, "justification": justification}

    def unaddressed(self) -> list[str]:
        return sorted(set(ANNEX_A_2022) - set(self.entries))

    def certifiable(self) -> dict:
        gaps = self.unaddressed()
        applied = [c for c, e in self.entries.items() if e["applicable"]]
        return {"scope": self.scope, "applied": sorted(applied),
                "excluded": sorted(c for c, e in self.entries.items()
                                   if not e["applicable"]),
                "unaddressed": gaps, "certifiable": not gaps}


if __name__ == "__main__":
    soa = StatementOfApplicability("LLM platform, production tenant")
    soa.apply("A.5.23", "Model inference is a cloud service",
              "cfg://gateway/allowed-providers.yaml", "configuration")
    soa.apply("A.8.2", "Operators hold privileged access to prompts",
              "rec://iam/quarterly-access-review-2026Q3", "record")
    soa.apply("A.8.10", "Retention is enforced on prompt logs",
              "test://retention/expiry-suite-2026-10", "test_result")
    soa.apply("A.8.12", "Egress to model providers can leak data",
              "cfg://dlp/egress-classifier.yaml", "configuration")
    soa.apply("A.8.15", "All inference events are logged",
              "rec://audit/chain-head-2026-10-16", "record")
    soa.apply("A.8.16", "Anomalous usage is monitored",
              "rec://siem/llm-usage-alerts", "record")
    soa.apply("A.8.24", "TLS and at-rest encryption",
              "test://crypto/tls-config-scan", "test_result")
    soa.exclude("A.8.28", "No application code is developed within this scope "
                          "boundary; the platform is configured, not coded")

    report = soa.certifiable()
    assert report["certifiable"], report
    assert len(report["applied"]) == 7 and len(report["excluded"]) == 1, report

    try:
        soa.apply("A.8.15", "we have a logging policy",
                  "doc://policies/logging.pdf", "policy")
        raise AssertionError("accepted a policy document as operating evidence")
    except ValueError:
        pass

    partial = StatementOfApplicability("partial")
    partial.apply("A.8.15", "logging", "rec://x", "record")
    assert not partial.certifiable()["certifiable"]
    assert len(partial.certifiable()["unaddressed"]) == 7

    print("ISO/IEC 27001:2022 SoA evidence mapping: OK")
    print(f"  applied {len(report['applied'])}, excluded {len(report['excluded'])}, "
          f"unaddressed {len(report['unaddressed'])}")

The blueprint

Intersecting Delegated Authority — the request path, with the decision points that must exist before the first model call:

flowchart LR
    USER[Invoking user<br/>entitlements] --> INT{Intersect}
    GRANT[Agent grant<br/>time-boxed] --> INT
    INT --> EFF[Effective permissions]
    EFF --> ACT{Action in effective set?}
    ACT -->|no| DENY[Deny + audit reason]
    ACT -->|yes| DO[Execute as the user, not the agent]
    EFF --> HOP[Delegate to agent B] --> INT2{Intersect again} --> EFF2[Narrower still]

Modular implementation framework

1. Principal entitlements — What the human may do, from the system of record.
2. Agent grant — What the agent may ever do, scoped per task.
3. Intersection at call time — Effective = user ∩ grant, computed per request.
4. Time-boxed grants — Expiry enforced, so delegation is not standing authority.
5. Chain intersection — Agent-to-agent delegation intersects again; a hop cannot widen.
6. Denial audit — Every denial recorded with the reason — the escalation signal.

Controls and acceptance parameters

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Questions to answer before approval

• Where is this control in the risk register and the Statement of Applicability, who owns it, and when was it last reviewed?
  Register entries are generated from the deployed control set, so every control has an SoA reference, a named owner and a review date that cannot silently lapse.
• If an intern invokes the agent, can it read data only an analyst may see?
  No. Effective permissions are the intersection of the agent's grant and the intern's entitlements, so anything the intern lacks is unavailable regardless of the agent's own grant.
• What authority does the agent have when nobody has invoked it?
  None that matters. The grant is time-boxed and only becomes effective when intersected with an invoking principal, so there is no standing authority to borrow.
• Can agent A delegate to agent B and end up with more permissions than A had?
  No. Chaining intersects again, so each hop can only narrow the set. Widening through a hop is the escalation path this design exists to close.
• How quickly does a revoked entitlement take effect for an in-flight agent?
  Within the entitlement cache TTL, which is bounded by the revocation SLO. The stale-grant window is documented rather than assumed to be zero.
• What is recorded when an agent attempts something outside its effective set?
  The agent, the invoking user, the attempted action and the reason for denial. Repeated denials are the signal that something is probing for authority it does not have.

Related reference architectures

• Part of enterprise ai compliance architecture.
• SOX agent permission and delegated access architecture for enterprise LLM applies the same mechanism under a different obligation.
• This pattern also governs PCI DSS 4.0 agent permission and delegated access architecture.
• Where this interacts with another regime, see HIPAA agent permission and delegated access architecture for enterprise.
• fedRAMP Moderate agent permission and delegated access architecture covers the adjacent case.
• If this is the blocker in front of you: enterprise AI infrastructure review.