# AI agent authorization, checked before each tool call runs. > Hawcx checks each AI agent tool call before it runs: a valid identity and an action within the agent's ceiling. Allowed, held, rejected or denied. Markdown version of . Last updated 2026-10-07. Hawcx checks who the agent works for and whether its policy allows the action. Then the call runs, waits for a person or stops. ## Authentication happens once. Authorization happens on every call. Hawcx AI agent authorization decides each tool call before it runs. The agent must hold a valid identity rooted in an employee, and the action must sit within that agent's ceiling. A login or a token settles who the agent is, once. Agents then act all day, so Hawcx gives each action its own decision. [AI agent identity, derived from a person](https://www.hawcx.com/ai-agents/identity) ## Every agent has a ceiling. Set from roles you already define. A ceiling is the most your policy lets an agent do. Hawcx reads the roles you already define to set each agent's ceiling. A sensitive action inside it can still be held for a person, and anything above it is rejected. ## One call, one of four answers. Rejected and denied are different. Allowed, held for approval, rejected, denied. - **Allowed**: Within the ceiling, so it runs. - **Held for approval**: A sensitive action your policy routes to a person. - **Rejected**: Valid identity, but the action exceeds the ceiling. - **Denied**: No identity, so it is blocked by default. Hawcx can check only the traffic that passes a point you control: this gateway, your network egress or a managed device. Anything without a valid identity is denied there. [Human approval for sensitive agent actions](https://www.hawcx.com/ai-agents/approvals) ## The check sits in the call path. Before the tool, not in the prompt. Tool call authorization runs between the agent and the tool: each call goes through the Hawcx Authorizer first. The Hawcx Gateway routes calls to the Authorizer. Have your own gateway? The Authorizer runs behind it. MCP tool calls are included. Hawcx works with MCP-compliant servers, CrewAI tools and any model provider, hosted or open source. The model can be tricked. Enforcement does not depend on it. [AI agent authentication platform](https://www.hawcx.com/ai-agents) ## Authorization questions, answered. Before this: [AI agent identity, derived from a person](https://www.hawcx.com/ai-agents/identity) After this: [Human approval for sensitive agent actions](https://www.hawcx.com/ai-agents/approvals) ### What is AI agent authorization? AI agent authorization is the decision, made before each tool call runs, on whether an AI agent may take that action. Hawcx bases it on two checks, run outside the model: a valid identity rooted in an employee, and an action within the agent's ceiling. Each call gets one of four answers: allowed, held for approval, rejected, denied. ### What is the difference between AI agent authentication and authorization? Authentication establishes which agent is acting and for whom, usually once, while authorization decides on every call whether this particular action may run. A token's scopes are set once, when it is issued, and every later call rides on that decision. Hawcx does both: each agent's identity is derived from the employee it works for, and every tool call is decided before it runs. ### What is an agent's ceiling? An agent's ceiling is the most your policy lets that agent do, set for each agent. Hawcx reads the roles you already define to set it. Inside the ceiling, your policy can still mark an action as sensitive, so it waits for a person. Calls above the ceiling are rejected, even when the agent's identity is valid. The ceiling is written as Cedar policy. ### What is the difference between rejected and denied? Rejected means the agent has a valid Hawcx identity, but the action exceeds its ceiling. Denied means the agent has no identity, so the call is blocked by default. Both are recorded. Hawcx can check only the traffic that passes a point you control: this gateway, your network egress or a managed device. ### Does Hawcx check every tool call or only risky ones? Hawcx checks every tool call, not only risky ones. Calls within the ceiling run, sensitive actions your policy names are held for a person, and anything over the ceiling is rejected. A routine read and a write outside the ceiling, from the same agent, each get their own decision, and every attempt is recorded.