An AI agent needs more than an API token. The framework for assigning a sponsor, mandate, permissions, autonomy and evidence before it can act.
4 concepts 4 decision paths
Share
The authority model
An agent’s useful scope should be explicit before it reaches a system of record.
An agent needs an authority envelope
Every production agent needs a named sponsor, a bounded mandate, scoped permissions, explicit autonomy and a record of what happened. An API token only answers one of those questions.
Treat the envelope as an entry condition for production. If a team cannot name the sponsor or describe the irreversible action, the agent is still a prototype.
An agent needs an authority envelope
Every production agent needs a named sponsor, a bounded mandate, scoped permissions, explicit autonomy and a record of what happened. An API token only answers one of those questions.
Treat the envelope as an entry condition for production. If a team cannot name the sponsor or describe the irreversible action, the agent is still a prototype.
Autonomous, delegated and supervised are different systems
An autonomous agent acts from its own bounded permissions. A delegated agent acts for a named user and inherits only the rights needed for that task. A supervised agent prepares the work and waits for approval before a consequential action.
The mode determines the control. A background inventory check may run autonomously. A contract amendment should arrive as a proposal for a human to approve.
Control identity, tools and data separately
Identity establishes who the agent is. Tool policy limits what it can call. Data policy limits what it can see. A single broad service account collapses all three controls into one opaque permission set.
Separate layers let security teams revoke a tool, data owners constrain a source and platform teams retire an agent without breaking every surrounding system.
Authority must expire as deliberately as it is granted
Register the agent and its sponsor. Approve its purpose and privileges. Observe it in operation. Review authority when the task changes. Revoke credentials, tool access and retained context when the agent is retired.
Most identity programmes are good at issuing credentials. Agent programmes need to be equally good at proving an agent should no longer have them.
The authority maturity ladder
Move from shared credentials to authority that can be explained, reviewed and retired.
Agent authority
The path from a prototype to a governed production agent
Shared credentials
Agent shares a broad application account
Unattributable risk
Named agent account
Identity is visible but privileges remain broad
Visible, exposed
Scoped permissions
Tool and data access match a defined task
Contained
Bounded authority
Sponsor, mandate and approval thresholds are explicit
Governed
Continuous review
Authority adapts, expires and remains auditable
Defensible
Start with the narrowest authority that lets the agent demonstrate value. Expand only after evidence shows that it needs more.
Authority decisions
Frequently asked questions
What is agent authority?
Agent authority is the bounded right of an AI system to take action. It joins five facts: who sponsors the agent, what outcome it may pursue, what it may access, which actions can proceed autonomously and what evidence must remain after it acts.
Why is a service account not enough for an AI agent?
A service account authenticates a workload. It does not name the human or business sponsor, describe the agent’s purpose, express its approval threshold or establish how long its authority should last. Those gaps matter when the system chooses actions at runtime.
When should an AI agent require human approval?
Use approval when an action is irreversible, financially material, externally binding or likely to affect a person’s rights. The useful test is blast radius: if a human would want to review the consequence afterwards, give them the chance to review it beforehand.
What evidence should an organisation retain for an agent action?
Retain the agent version, sponsor, mandate, identity, user delegation where applicable, retrieved context, tool calls, approval events, result and final action. The aim is to reconstruct both what happened and why the agent had authority to do it.