How Should Authority Be Delegated to an AI Agent?

Authority is more than a permission

A permission describes what a system will technically allow. Authority explains why a particular actor may use that permission in a particular context. An agent might possess an API token that can delete records, for example, while having no legitimate authority to delete records for the task it was given.

Good delegation therefore combines technical enforcement with task meaning. The receiving system should be able to evaluate not only “can this credential call the endpoint?” but also “is this action within the authority granted to this agent for this purpose?”

The dimensions of a useful grant

A delegation becomes meaningful when its boundaries can be stated and enforced. The most important dimensions are:

• Actor: the specific agent identity receiving the grant.
• Principal: the human or organisation from whom the authority originates.
• Action: what the agent may read, create, change, send, approve or delete.
• Resource: the account, file, project, application or dataset in scope.
• Purpose: the task or outcome for which the authority exists.
• Time: when the grant begins, expires or must be renewed.
• Conditions: spending limits, destination restrictions, approval thresholds or other policy checks.

A broad role can still be useful, but the final authority should be narrowed by context wherever possible.

Use progressive authority

An agent does not need its maximum possible authority at the beginning of every task. It can start by reading available information, develop a plan and request stronger authority only when a proposed action requires it. This reduces exposure and gives the user a meaningful approval point.

Progressive authority also improves the approval experience. A user can review a specific action with concrete context rather than approve a vague request for permanent access. The grant can then expire after the action or task.

Approval should be tied to consequence

Requiring approval for every minor step makes the agent unusable. Never requiring approval makes it unsafe. The boundary should reflect the reversibility, value, sensitivity and ambiguity of the action.

Reading a public page and organising local notes may fit within standing authority. Sending a message, publishing content, changing access rights, transferring money or deleting data deserves a stronger check. An organisation may define these rules centrally; an individual user may define them in the agent workspace.

An approval record should identify exactly what was presented to the approver. Approval of a plan is not automatically approval of every later variation.

Expiry, review and revocation are part of delegation

Authority that cannot be withdrawn is not well controlled. Task-specific grants should normally end when the task ends. Persistent agents may need renewable authority, but their owner, purpose and recent use should be reviewed.

Revocation should disable the agent’s effective access without requiring the human principal’s entire account to be disabled. That is another reason to keep the agent identity distinct from the user identity.

Related answers