Continuous authorization re-evaluates an identity's access for the life of the session, rather than deciding once at login and trusting the session afterward. Access is granted just-in-time, only when needed and only for as long as needed, and then checked against policy as conditions change, so it can be narrowed, stepped up or revoked at any point.
Per-action policy evaluation. Each action, whether a login, a database query or an API call, is evaluated against authorization policies that decide whether this principal may take this action on this resource, given the current context.
Context and risk signals. Policies and risk models draw on attributes such as user behavior, location and device posture, flagging anomalies and changes in risk as they occur.
Dynamic response. When conditions change or an action falls outside policy, the system can step up authentication, narrow permissions, require approval or revoke access without waiting for the next login.
Login-time authorization makes one decision and then trusts the session. Continuous authorization responds as conditions change, so a policy can be enforced the moment an issue is detected rather than at the next login. By doing this, the time between a compromise and its containment shrinks. It also works for identities that never login: CI/CD pipelines, Kubernetes workloads and AI agents don't establish sessions a human can approve, so access has to be granted just-in-time and each action checked as it happens.
High-risk admin actions. Login-time authorization can't intervene when an admin attempts an action that warrants extra review. With continuous authorization, policies can require approval before actions such as dropping a database table or disabling multi-factor authentication.
AI agent workflows. When an AI agent requests access to a production database, access is granted just-in-time, only when the agent needs it, and revoked when the task ends. Each action the agent takes on the database is evaluated against policy, and continuous authorization re-evaluates the risk throughout the session, revoking access if conditions change.
Device posture changes mid-session. Most organizations check device posture at the start of a session. If the laptop becomes infected partway through, continuous authorization can revoke access once the risk score passes the acceptable threshold.
Location. A login from an unusual location triggers step-up authentication. A connection from California at noon followed by one in Florida 10 minutes later is blocked or challenged.
Unusual activity. A user who normally works during office hours attempts access at 3 a.m. and the system flags the request and restricts access.