The Real AI Agent Problem Is Authority

A correct report can still be an unauthorized disclosure

An agent reconciles a case correctly. Its delivery worker can file the report internally or email an external processor. The owner authorized only internal filing.

Accuracy answers whether the report is right. Authority answers whether this recipient may receive it. The technical connection is real. Permission to use it must be explicit.

This is the illustrative workflow in Authority by design, the companion whitepaper. The decision for leadership is to give the agent the smallest useful action an accountable owner can authorize.

A sentence asks. A boundary decides.

“Do not send without approval” expresses intent. A protected authorization check determines whether sending is permitted. Put the boundary outside the model’s reasoning, where it can still prevent the action. The model must not be able to rewrite the rule that controls the send.

OWASP recommends limiting tools and permissions, then enforcing policy in downstream systems. NIST separates policy decisions from enforcement. Prompts guide behavior. Controls constrain effects. Logs record what happened.

Make permission specific enough to enforce

Replace “handle this case” with one bounded effect. Bind the report, version, case and destination together. Changing any of them requires a new check.

An authority brief names the actor, action, scope, conditions and evidence, duration, and revocation owner. Keep it available to the receiving service, not only in the conversation. Knowing who a worker is does not establish permission for this task.

A handoff can narrow authority. It cannot invent more. The worker inherits a smaller job, not permission to use every destination its service account can reach. Keep the original limits visible at every handoff and verify that each delegating actor holds the authority it delegates.

Every route must meet the same final check

An agent’s refusal cannot stop a worker or retry that bypasses it. Enforce permission on every route that can commit the effect. Check current authority and policy immediately before execution.

Keep allow, request authority, deny, and stop distinct. A pending request grants no permission to send. Missing evidence, an expired grant, or a revoked grant means the old decision cannot justify proceeding.

Retain the actor, grant, report version, destination, policy version, decision time, and observed result. The affected system supplies the outcome. The agent’s account alone is insufficient. If a delivery times out, reconcile its status before retrying.

Expand authority only with evidence and an owner

Test changed recipients and report versions, injected instructions, unrelated parent grants, revocation while queued, and timeouts followed by retries. Run the probes through direct, queued, and retry routes. Use receiving-system evidence.

Set acceptable stopping delay before testing. A stopped queue alone does not prove that an external service stopped. Record useful completions alongside blocked actions, and investigate every unexplained effect before expanding access.

The workflow, architecture, and acceptance tests are illustrative design proposals. They do not establish measured effectiveness or certification. Review one critical workflow with its business owner, engineering lead, security lead, and executive sponsor before broadening access.