Giving AI Agents the Same RBAC Rules as Your Users: Building a Laravel Permission Layer LLMs Actually Respect

AI agents don’t use web browsers. They don’t click buttons, submit forms, or trigger standard HTTP requests that pass through your middleware stack. They execute logic via API calls, background queues, or CLI commands using tool definitions. When an LLM decides to "fetch the latest invoices," it usually calls a tool function. If that tool function just runs Invoice::all() , your AI agent just became a god-mode data leak. The fundamental problem with integrating LLMs into existing applications is that agents operate in a detached, stateless execution context . They don't have a session cookie. They don't inherently know who invoked them. If you rely on the system prompt to tell the LLM, "Only show John his own data," you are trusting a probabilistic text generator to enforce your security boundary. That is a production incident waiting to happen. To build a secure AI agent in Laravel, you must treat the LLM not as a user, but as a proxy for the user. The agent must inherit the exact Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) constraints of the human sitting behind the keyboard, and it must enforce those constraints at the database query level, not the prompt level. TL;DR AI agents bypass traditional web middleware because they execute logic through background tools and function calling. Never trust the LLM to filter its own results. Force filtering through Eloquent scopes and authorization gates. Pass the acting user's identity explicitly into the agent's execution context using Laravel's auth guards or custom context DTOs. For complex rules (hierarchies, multi-tenancy, ABAC), standard role packages fall short. Tools like hosseinhezami/laravel-permission-manager are required to evaluate deep permission trees inside agent tools. Audit every tool execution with the acting user's ID, not the system service account. 📋 Table of Contents 1. The "God-Mode Tool" Problem 2. Passing Identity Down the Execution Chain 3. Enforcing RBAC Inside LLM