LIVE
Mistral Makes Large 4 Available as Open Weights29/10/26 · Mistral AI|Gemini 4 Carbon tops the Artificial Analysis Intelligence Index v529/10/26 · Google|Mistral Large 4 now available on Hugging Face29/10/26 · Mistral AI|Google Introduces "Gemini 4 Carbon" as Next Step in Its Model Lineup28/10/26 · Google|DeepMind unveils Genie 4, a new generation of world model27/10/26 · Google DeepMind|Anthropic files IPO prospectus, with risk disclosures taking center stage26/10/26 · Anthropic|Robot policy trained only in simulation matches top real-world systems26/10/26|OpenAI unveils GPT-6.1 Terra, a model built for computer use26/10/26 · OpenAI|New benchmark checks whether LLMs actually test their temporal medical claims29/10/26|An ODE-based sampling method speeds up discrete diffusion models29/10/26|OpenAI revises its Model Spec with five guiding values for AI behavior29/10/26 · OpenAI|Inside Proton's internal clash over its AI pivot29/10/26 · Proton|Mistral Makes Large 4 Available as Open Weights29/10/26 · Mistral AI|Gemini 4 Carbon tops the Artificial Analysis Intelligence Index v529/10/26 · Google|Mistral Large 4 now available on Hugging Face29/10/26 · Mistral AI|Google Introduces "Gemini 4 Carbon" as Next Step in Its Model Lineup28/10/26 · Google|DeepMind unveils Genie 4, a new generation of world model27/10/26 · Google DeepMind|Anthropic files IPO prospectus, with risk disclosures taking center stage26/10/26 · Anthropic|Robot policy trained only in simulation matches top real-world systems26/10/26|OpenAI unveils GPT-6.1 Terra, a model built for computer use26/10/26 · OpenAI|New benchmark checks whether LLMs actually test their temporal medical claims29/10/26|An ODE-based sampling method speeds up discrete diffusion models29/10/26|OpenAI revises its Model Spec with five guiding values for AI behavior29/10/26 · OpenAI|Inside Proton's internal clash over its AI pivot29/10/26 · Proton|
+ nAIvigateA SHEET FOR PEOPLE WITHOUT 2 HOURS
+ nAIvigate · fiches / controle-acces-mac-dac-rbac-abac-agents-ia
▣ fiche-010.md ×
□ index.md
☰ ContentsVerdictThe five models, where they fit, their limitsSix rules for an agent's permissionsWarning signs

Access control: five models, and the agent that inherits everything.

The five access control models answer a single question: who decides to open the door. AI agents raise it again, because most of them act with the permissions of the person who launches them, with no identity or trail of their own.

Verdict

the essentials in 10 seconds3 rows
HUMANSFor employees, well-kept roles cover most needs. RBAC remains the enterprise baseline.BASELINE
AGENTSAn agent acting with the user's token inherits all their permissions, with no trail of its own.DECISIVE
CONTEXTOnly ABAC can weigh the tool, the data, the time and the device. It is the model that fits agents.TARGET

Who decides to open the folder?

the same access seen by each model5 models

Léa wants to open the Finance folder. Depending on the model, the decision belongs to the system, the owner, the role, a rule or a set of attributes. The further right, the finer the decision, and the more discipline it requires.

SAME FINANCE FOLDER, FIVE WAYS TO DECIDE MAC decides: the system Clearance: Confidential < Label: Secret DENIED DAC decides: the owner Paul, owner shares Léa: read GRANTED RBAC decides: the role Léa → Finance role → read, edit GRANTED RuBAC decides: the rule Rule: access 8am to 8pm vs Request at 9:04pm DENIED ABAC decides: the attributes Finance AND managed device AND in France GRANTED FROM MOST RIGID TO MOST FLEXIBLE MAC RuBAC RBAC DAC ABAC

The five models, where they fit, their limits

where you already find them5 rows
MACThe system compares the person's clearance with the data's label; nobody can override it. Limit: very heavy to run outside classified settings.DEFENCE
DACThe owner shares as they see fit: file permissions, shared folders. Limit: access spreads with no central control.FILES
RBACPermissions go to roles, people get roles: directory groups, cloud roles. Limit: role explosion and catch-all roles.ENTERPRISE
RuBACRules independent of identity: time windows, allowed addresses, firewall rules. Limit: rules pile up and contradict each other.FIREWALL
ABACA policy combines attributes of the person, the resource, the action and the context (framework described in NIST SP 800-162). Limit: only as good as the attributes.CLOUD

And where does the AI agent fit?

the most common risk in 20262 patterns

Most agents act with the token of the person who launches them. They see everything that person sees and act in their name, with no way to tell what the person did from what the agent did.

WHAT OFTEN HAPPENS Léa Agent with Léa's token Email CRM Drive Finance Everything Léa can do, the agent can do too, and nobody sees it. WHAT IT SHOULD BE Léa asks Agent: own identity Policy: tool, data, context Write: approval Log: action attributed to the agent AND to Léa, token expired at the end of the session Least privilege, tool by tool, and a trail the security team can read. → Ask: with which permissions does the agent act, and who sees it in the logs?

Six rules for an agent's permissions

to require before going live8 rows
1 · identityAn account of the agent's own, never a human's token nor an admin account.BLOCKER
2 · scopeLeast privilege tool by tool: read-only by default, every write justified.
3 · durationShort-lived tokens, limited to the session or the task. With MCP, explicit OAuth scopes.
4 · approvalAny irreversible action (send, payment, deletion) goes through human approval.DECISIVE
5 · logEvery action attributed to the agent and to the person who asked, readable by the security team.
6 · reviewAgent permissions reviewed like human ones, and removed when the use ends.
Claude Code ↗Permission modes, allowed and denied tools: sheet no. 7 and the free checker.TOOL
the chain ↗Where to place guardrails in a full AI stack.SHEET 9

Warning signs

one is enough to dig deeper6 rows
tokenThe agent reuses the user's session or token.BLOCKER
adminAn admin service account "just to make it work".BLOCKER
roleA catch-all role created for the agent that nobody can describe.
promptThe restrictions live in the prompt, not in the access policy.
logLogs show the user, never the agent.
revocationThe agent's access is never removed, even after the project ends.
Do your AI agents have their own permissions? We help you map your agents' access, give them their own identity and an access policy, and make it auditable.
TALK TO nAIvigate STUDIO →
⎇ mainfiche #010 · securitesources: NIST SP 800-162 : guide de l’ABAC · ANSI INCITS 359 : norme RBAC · Spécification MCP : autorisation fondée sur OAuth 2.1 · Synthèse nAIvigate, octobre 2026
Follow nAIvigate | naivigate.com/en/fiches