Governing Delegated Authority in AI Agents

AI governance has traditionally concentrated on models: their training data, performance, bias, transparency, safety, and intended use. Agentic systems create a different control problem. Once software can select tools, call APIs, retrieve records, initiate workflows, spend resources, modify state, or communicate with external parties, the central governance question becomes one of delegated authority. The institution is no longer governing only an analytical artifact. It is governing a machine actor that can exercise permissions in an operational environment.

01From model risk to authority risk

An AI agent does not possess authority in the legal or institutional sense on its own. Authority is conferred through credentials, integrations, workflow design, and the decisions of people who allow a system to act. That makes every agent deployment a delegation arrangement. A person, team, application owner, or institution is effectively saying: this software may perform these actions, for these purposes, on these resources, for this period of time.

The governance failure is to treat technical access as equivalent to legitimate authority. A token may permit an action that policy would not. A service account may remain active after the business purpose changes. A workflow may give an agent broad data access because it is convenient for orchestration even though only a narrow subset is necessary. The result is an authority surface that expands faster than the organization can explain it.

Agent governance should begin with the proposition that every machine action is an exercise of delegated institutional authority.

02A six-part authority envelope

Paris AI proposes an authority envelope with six elements that should be explicitly represented for consequential agents:

• Principal: the person, team, service, or institution on whose behalf the agent acts.
• Purpose: the task or outcome for which authority was delegated.
• Scope: the systems, data, tools, counterparties, and action classes the agent may access.
• Conditions: contextual constraints such as transaction value, geography, risk tier, data classification, or workflow state.
• Duration: the time period or session boundary within which the authority remains valid.
• Escalation: the conditions under which the agent must stop, request approval, or transfer control to a human.

This envelope is intentionally more expressive than ordinary role-based access control. Roles answer who can access a resource. Agent governance must also answer why, under which context, for how long, and with what obligation to stop.

03Identity should be separate from capability

A durable governance architecture separates the identity of an agent from the models and tools it uses. Models can change. Prompts can change. Toolchains can change. An enterprise may route the same business agent across different foundation models because of cost, latency, jurisdiction, or availability. If identity is tied to one model endpoint, accountability fragments every time the technical implementation changes.

The more resilient pattern is a persistent agent identity that represents the operational actor, with model instances, credentials, tools, owners, and policies attached as changing attributes. This makes it possible to revoke the actor while preserving its historical record, compare behavior across model upgrades, and understand which delegated authority was in effect at the time of an action.

04Authorization should be per action, not only per session

Long-lived sessions create hidden accumulation of privilege. A safer pattern is to evaluate authorization at meaningful action boundaries. Reading a public document is different from exporting customer records. Drafting a payment instruction is different from submitting one. Creating a support recommendation is different from changing an account entitlement.

Action-level authorization does not require human approval for every step. It requires the system to evaluate policy before consequential steps and to obtain stronger evidence or fresh authorization as risk increases. Low-risk actions can proceed automatically. Higher-risk actions can require additional context, dual control, or explicit human confirmation.

05Evidence is part of authority

Institutions need to reconstruct not only what an agent did but why it was permitted to do it. A useful evidence record therefore includes the agent identity, principal, policy version, relevant context, authorization result, tools invoked, material inputs, output or action, and any human approval or exception. The goal is not infinite logging. The goal is sufficient evidence to explain the exercise of authority.

This aligns with the broader direction of AI risk management frameworks such as the NIST AI Risk Management Framework and AI management system standards such as ISO/IEC 42001, which emphasize governance, documentation, accountability, and ongoing risk management. Agentic systems add a runtime layer to those organizational disciplines.

06Design implication: authority should decay

Persistent authority is convenient for software and dangerous for institutions. Delegated permissions should be designed to expire, narrow, or require renewal when time, context, model state, ownership, or task purpose changes. An agent that has been inactive for weeks should not automatically resume with the same rights. An agent transferred to a new business process should not inherit permissions from the old one. A model upgrade that materially changes capability should trigger re-evaluation of the authority envelope.

07Research agenda

The next generation of AI governance will need common patterns for agent identity, delegated authority, contextual authorization, revocation, machine-readable policy, and evidence. The strategic question is no longer whether organizations can give AI systems access. They already can. The question is whether they can make machine authority explicit enough to govern, inspect, and withdraw.

Selected references

• NIST AI Risk Management Framework
• ISO/IEC 42001:2023 — Artificial intelligence management system