# Authorization

Deciding whether a given actor is allowed to take a given action. Distinct from authentication (proving who you are); authorization is what an agent may do.

Learn more: [Agent Authorization](/content/learn/ai-agent-authorization/index.html).

Part of [the Agent Control Fabric](/content/platform/index.html): Highflame's identity, policy, and enforcement substrate for AI agents.

## Keep exploring the glossary.

**Blast radius**  
The set of systems and data a compromised agent or credential could reach. Identity-scoped access shrinks it; cascade revocation contains it.  
Read → [Link](/content/glossary/blast-radius/index.html)

**Breakout controls**  
Runtime controls that keep an agent aligned to its mission: containing, redirecting, or stopping it when it veers off course, before the action lands.  
Read → [Link](/content/glossary/breakout-controls/index.html)

**Cascade revocation**  
Revoking a parent credential instantly invalidates everything it delegated, collapsing the affected delegation tree rather than waiting for tokens to expire.  
Read → [Link](/content/glossary/cascade-revocation/index.html)

**Cedar**  
An open, formally analyzable policy language. Highflame authors authorization policy in Cedar and enforces the same policy at every boundary an agent crosses.  
Read → [Link](/content/glossary/cedar/index.html)

**CIBA**  
Client-Initiated Backchannel Authentication: an out-of-band flow that pauses a sensitive agent action for explicit, attributable human approval.  
Read → [Link](/content/glossary/ciba/index.html)

**Code agent**  
Autonomous software that reads code, runs commands, calls tools, and changes systems on a developer's behalf. Securing one means controlling what it can access while it runs, and proving afterward what it did.  
Read → [Link](/content/glossary/code-agent/index.html)