• LOGS
  • POLICY
  • TREE
  • HUMAN

How to debug authorization failures with your AI

Connect Aserto to your AI client to turn opaque access denials into clear, actionable insights.

Ask AI about this page

Short answer

Why is this user being denied access?

Your AI pulls recent decision logs and maps them against your current policy logic to find the specific rule causing the block. You get a clear explanation of the failure point without digging through raw JSON logs manually.

Investigation outcomes

Where your debugging efforts land.

The AI categorizes every investigation into one of these four outcomes.

LOGS

Identified log gaps

The AI finds specific denied requests in your history. You get the exact timestamps and user IDs that failed.

POLICY

Broken policy logic

The AI spots where a policy rule contradicts your intent. You see which specific condition triggered the denial.

TREE

Decision path clarity

The AI traces the logic through your decision tree. You see the exact branch where the access request fell through.

HUMAN

Manual policy updates

The AI identifies when a policy is working as written but is logically wrong for the user. You decide how to rewrite the rule.

The workflow

What your AI does when a denial occurs.

Instead of you hunting for errors, your agent performs a targeted audit of your authorization state.

  1. Fetch recent denials

    The AI scans your recent history to find the specific event you're asking about.

    query_decision_logs

  2. Trace the logic

    The agent follows the decision path to see how the request moved through your rules.

    authz_decisiontree

  3. Verify current state

    The AI checks if the user's current attributes actually satisfy the policy requirements.

    authz_is

  4. Summarize the cause

    The agent combines the log data and the policy tree into a plain English explanation of the failure.

    query_decision_logsauthz_decisiontree

Try it

Copy these to start.

Use these prompts to kick off an investigation.

Starting points

Swap out the bracketed info for your specific user IDs or policy names.

Aserto Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_XOpJU2PJe7LAxPuGtGU6XTuW4mAiWsbg1RviddXw/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Aserto capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "aserto-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_XOpJU2PJe7LAxPuGtGU6XTuW4mAiWsbg1RviddXw/mcp"
    }
  }
}
Copy into chat04

  • Why was user 'alice_dev' denied access to the 'production_db' resource in the last hour?

  • Show me the decision tree path for the most recent access denial in the 'billing' service.

  • Check if the current policy for 'admin_role' would allow access to 'user_7742'.

  • Analyze the decision logs for 'service_api' and tell me why 'bob_manager' is getting 403 errors.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Aserto once, then ask.

One connection gives your AI access to your authorization data. Your credentials stay encrypted and secure.

Connect Aserto to your AI

FAQ

How this task behaves

  • 01

    Can the AI change my authorization policies?

    No. The AI can only read logs and inspect policy trees to explain why things happened. You must manually update your policies.

  • 02

    Does the AI have permission to delete users?

    No. The tools provided are strictly for querying and inspecting authorization decisions.

  • 03

    Can I use this to audit past access attempts?

    Yes. The AI uses decision logs to look back at specific denied or allowed requests.

  • 04

    Will the AI suggest a fix for a denied request?

    Yes. By analyzing the decision tree and the user attributes, the AI can explain what needs to change for access to be granted.

  • 05

    Does the AI see my raw user passwords?

    No. The AI only interacts with authorization attributes and decision logs provided by Aserto.

  • More questions about Aserto? The Connector page answers them. See everything the Aserto Connector can do

Connect Aserto to Claude, Cursor, ChatGPT & more