# Intent-Aware Authorization for Zero Trust CI/CD

arXiv: https://arxiv.org/abs/2504.14777 · HTML: https://mlsanity.com/paper/2504.14777/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Apr 2025.

## Built on by (most cited first, 1 of 1)

- [Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things](https://mlsanity.com/paper/2505.23835/) (2025)

## Abstract (arXiv)

This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluate runtime context, justification, and human approvals before issuing access credentials. The system builds on SPIFFE-based workload identity and credential brokers, and enables fine-grained, auditable authorization. This is the third paper in a series on Zero Trust CI/CD design patterns.