This paper introduces Intent-Governed Access Control (IGAC), a server-side authorization layer for AI agents. IGAC generates a short-lived intent certificate from a trusted request, narrows the authorized tool manifest, and checks proposed tool and payload effects before execution. This approach prevents static permissions from exceeding user requests and relies on certificate fidelity and sound effect bounds.