Permission isn't purpose: Intent-based authorization in Omnigent

Databricks’ Omnigent addresses a critical gap in AI agent authorization by shifting focus from *who* can act to *why* an action is being taken. Traditional identity-based controls, designed for human users, fail to prevent prompt injection attacks where malicious instructions are embedded in data the agent processes. Omnigent’s intent-based authorization binds each session to a declared purpose, denying actions that fall outside this scope, even if the agent’s identity permits them.

The system requires human approval for the agent to draft an intent from a description, ensuring the purpose aligns with the task. Once set, the intent cannot be altered by the agent, preventing runtime manipulation. Omnigent evaluates every tool call against this intent, returning ALLOW, ASK, or DENY verdicts. For example, an agent tasked with running a data quality check and posting a summary would be denied access-granting actions, even if its identity permits them, unless explicitly included in the intent.

A demonstration shows how an attacker could hide an instruction in a data field—such as a support note—tricking the agent into granting unauthorized access. Without intent-based controls, the agent would execute the hidden instruction, logging it as routine activity. With intent policies enabled, the same injected action is blocked, while the agent’s legitimate task—reading the table and posting a summary—completes as requested.

Intent-based authorization is one of several contextual policies in Omnigent, designed to work alongside others like session-risk scoring for layered defense. The intent is defined per use case and cannot be inferred generically, as only the agent owner knows which actions are legitimate. Changes to the intent directly alter allowed actions, while injected instructions remain ineffective, ensuring tamper-resistant enforcement.