An artificial intelligence agent can produce a convincing response and initiate an action that no one actually entrusted to it. According to the analysis published here, the boundary between technical capability and delegated authority must become a central focus of AI governance.
- An AI agent can act without having received the mandate to act.
- Each action must trace back to an explicit human mandate with defined scope, duration, and exclusions.
- Control weakens across chained agents, so checks must come before irreversible consequences.
- Before extending autonomy, leaders must prove who authorized the action, within which limits, and how to regain control.
The author uses a fictional example of a company that entrusts an agent with analyzing customer complaints. To speed up processing, it gives the agent access to its CRM, i.e., its customer relationship management tool, and then to a refund tool. The agent first recommends commercial gestures, before executing them within the technical limits of its access. Yet, the ability to trigger a payment does not mean having received the mandate to decide that payment.
The quality of responses is not enough to govern action
The evaluation of a model and that of its authority answer two different questions. The first concerns the relevance or accuracy of a result, the second the legitimacy of an action in a given situation. An accurate recommendation can exceed an agent’s mandate, while an uncertain recommendation may remain without consequence if its execution is properly framed.
For a general management or an IT department, the question becomes concrete: what decisions can the system make, with what means, on whose behalf, and to what extent? A list of authorized tools is a start, but it does not specify acceptable usage conditions. Access to the CRM can be used to view a file, modify data, or export contacts. These operations do not have the same purpose nor the same consequences, and governance must link them to an explicit mandate.
Control erosion builds up in the sequences
The author speaks of control erosion when the actual ability of managers to understand, limit, and correct actions diminishes over the system’s operation. An agent gathers information, a second synthesizes it, a third prepares a decision, and a fourth executes it. Each can fulfill its immediate role, while the whole can produce a consequence the original manager had not envisaged. A hypothesis becomes a working datum, that datum becomes a justification, then the justification triggers an action.
The authority drift can remain subtle. It appears when a system effectively expands its scope, for example by turning an analysis instruction into an execution authorization. The appropriate level of oversight is therefore the chain that links the human mandate to the final consequence. The presence of a validation button is not enough to establish effective control: the supervisor must have understandable information, sufficient time, and appropriate intervention means. In the refund example, validation should occur before the operation and present the amount, the reason, the uncertainties, and the applicable rule.
Organize verifiable control
The author proposes five requirements. First, formulate the mandate: objective, scope, duration and excluded actions, because “handling complaints” is too broad if authorized decisions are not specified. Next, align permissions with the mandate, limiting access to necessary operations and being able to withdraw them at the end of the task. Controls must also be placed before consequences that are hard to correct, for example using a monetary threshold or a change of recipient. Then comes the preservation of an exploitable, proportionate, and data‑protective trace. Finally, test the recovery capability, because some consequences are irreversible, the ability to stop the system must be evaluated before deployment.
Supervision rules can themselves become unsuitable when volume, tools, or responsibilities change. A deterministic rule engine can make certain checks reproducible, without guaranteeing the quality of received facts nor the relevance of the rules. Before extending an agent’s autonomy, decision‑makers should be able to demonstrate who gave it the right to act, within what limits, and how to retake control.
