Software used to wait. A person opened the application, selected the function and confirmed the result. Automation reduced some of those steps, but its boundaries were usually explicit: a workflow executed predefined instructions against predefined systems.
AI agents change the shape of that relationship. They interpret goals, select tools, generate intermediate plans, communicate with other systems and adapt when conditions change. This makes them useful precisely because every step does not need to be specified in advance.
It also creates a control problem. The system that decides how to achieve an objective may be operating inside the same environment that decides whether the objective is allowed.
An authenticated agent is not necessarily an authorised agent. A capable agent is not necessarily a legitimate actor.
Three properties that should not collapse
Capability is the set of actions a system can technically perform. Identity is the entity, service or principal to which activity is attributed. Authority is the permission to perform a specific action under specific conditions.
Traditional access systems often compress these properties into a token. If the account possesses the credential, it receives the permission. That model becomes fragile when credentials can be delegated across agent chains, when sessions persist beyond the human interaction that initiated them, or when context changes faster than static roles can express.
Delegation needs provenance
An agent may act for a person, a department, a company or another agent. Each delegation should answer more than “which account initiated this?” It should establish who authorised the objective, what scope was granted, which conditions apply, how long the delegation remains valid and what evidence is retained.
Without that provenance, accountability becomes retrospective guesswork. Logs may show what the system did without establishing whether the system was entitled to do it.
Context belongs in the permission
Consequential authority is rarely universal. A maintenance agent may be permitted to restart one service during an approved window, but not to alter its security policy. A procurement agent may compare offers but require independent authorisation before committing funds. An autonomous system may operate within a defined physical area but need escalation when people or protected assets enter the environment.
These constraints are not exceptions around intelligence. They are the architecture through which intelligence becomes governable.
Reconnect execution to reality
Some permissions can be resolved entirely through digital policy. Others depend on facts about the physical world: the expected human is present, a component is authentic, a facility is controlled, a device is in the intended location or a protected event has occurred.
In those cases, the agent should not be asked to infer its own authority from the same information it may be able to generate or manipulate. A separate verification path can establish the physical condition and translate it into a bounded decision.
The result is not a blanket human-in-the-loop requirement. It is a proportional control model. Low-consequence actions can remain fluid. High-consequence actions encounter stronger, independently verifiable boundaries.
Design the denial path
Agent systems are often demonstrated through successful execution. Production safety depends equally on what happens when authority is absent, ambiguous or expired. Can the system stop safely? Can it explain what evidence is missing? Can a human review the proposed action without inheriting an unreadable chain of agent reasoning?
A useful authorisation layer should produce clear outcomes: permit, deny, record or escalate. It should separate protected mechanisms from the minimum explanation required for operational accountability.
From assistants to institutions
As agents move from individual productivity tools into organisational infrastructure, their permissions become institutional design. The question is no longer only whether a model follows instructions. It is whether an organisation can demonstrate that the instruction, actor, context and action were legitimately connected.
That is why agent identity alone is not enough. The intelligent age needs verifiable authority: explicit permission, grounded context and execution that remains bounded when capability scales.
This field note describes a control principle. Deployment requirements depend on the system, threat model, institution and applicable law.