Why AI agents need authority outside the model

The proposal is untrusted by construction

Prompt-level caution asks a model to police itself with the same machinery an attacker manipulates. Instruction hierarchies, refusal training and system prompts all live inside the same probability distribution that produced the action. They reduce frequency; they do not create a boundary.

Treat every agent output as an untrusted proposal: an exact action, an exact target, and a claimed justification. The runtime's job is to decide whether that specific tuple may cross into a real system right now.

Authority is a contract, not a prompt

An authority contract names the action, the target resource, the scope, the time window, and the human or policy grant that permits it. It is evaluated by code the model cannot edit and cannot see, and it fails closed when a field is missing or mismatched.

In practice this means a refund approval bound to one order and one amount, or a deploy grant bound to one change record and one environment. Anything broader is standing permission wearing a governance label.

Connector acknowledgements are not proof

Most agent stacks stop at the API response. A 200 is evidence that a request was accepted, not that the source of truth now holds the expected state. Retries, timeouts and partial commitment routinely produce a confident narrative and an incorrect world.

Governed execution closes the loop by reading the final state back from the designated source and sealing expected against actual in a receipt.

What to change first

Pick the one workflow where an agent can already create an irreversible effect. Write its authority contract by hand. If you cannot express the grant in one sentence with a target and a limit, the workflow is not ready for agent access.