Skipping `next` stops that function. It does not decide a later function. Check the subject again before privileged work.

## After the subject is known

| Check | Where |
| --- | --- |
| Bearer accepted | The hook on [Semantic Kernel](/docs/agent-frameworks/semantic-kernel) |
| Allowed tools | Trust-store row, when your process enforces it |
| The action itself | [Authorization](/docs/concepts/authorization) using the subject |

Revoke in [Agents](/docs/console/agents) stops new tokens when the subject is the OIDC client id. Tokens already issued last until `expires_in` unless a later check rejects them.

When the token is an [RFC 8693 delegation](/guides/agent-delegation), the person stays the subject and the agent stays the actor. Authorizing the agent as the user skips the delegation.

## Related

| Read | To learn how to |
| --- | --- |
| [Custom channel auth for Semantic Kernel](/docs/ai/semantic-kernel/channel-auth) | Admit the caller |
| [Enriching instructions for Semantic Kernel](/docs/ai/semantic-kernel/enriching-instructions) | What the model is allowed to see |
| [Authorization](/docs/concepts/authorization) | Pick the check after the subject |