Login Alone Isn't Enough: Per-Operation Authorization and Recovery for AI Agent Tools

A valid login only establishes identity, but an agent may keep acting after a user has lost a permission, so each tool call must be checked on its own. This article presents an architecture exercise rather than a report of a completed AWS deployment, and its test scenarios are proposals. It distinguishes authentication, authorization for a specific operation and resource, and approval tied to a concrete proposed change. It compares AWS API Gateway IAM invocation with Lambda authorizers, and argues that shared MCP routes need fine-grained checks enforced by the executor. It also notes that policy changes and cached authorization results can delay revocation, and that interrupted sensitive operations require durable evidence before any replay.