{
  "id": 5950755,
  "title": "Giving AI Agents the Same RBAC Rules as Your Users: Building a Laravel Permission Layer LLMs Actually Respect",
  "url": "https://urgent.news/2026/09/06/giving-ai-agents-the-same-rbac-rules-as-your-users-building-a-laravel",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-06T09:19:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hosseinhezami/giving-ai-agents-the-same-rbac-rules-as-your-users-building-a-laravel-permission-layer-llms-189"
  },
  "original_language": "en",
  "account": "AI agents do not use web browsers or traditional HTTP requests to execute logic. Instead, they call tools, background queues, or CLI commands using defined API functions. When an LLM decides to fetch the latest invoices, it typically does so by calling a tool function. If the tool function simply runs Invoice::all(), the AI agent can inadvertently become a god-mode data leak.",
  "summary": "AI agents don’t use web browsers. They don’t click buttons, submit forms, or trigger standard HTTP requests that pass through your middleware stack. They execute logic via API calls, background queues, or CLI commands using tool definitions. When an LLM decides to \"fetch the latest invoices,\" it usually calls a tool function. If that tool function just runs Invoice::all() , your AI agent just…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}